Windows Forum

Ask something
Discussion Locked

raw sockets

0 helpful
8 replies

by lechkung

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
What's all this talk about raw sockets in Microsoft's upcoming XP? What is raw sockets (Win XP), and how does it differ from the Win 9x?

8 replies

by colin_seel

Key: Tcpip\Parameters
Value Type: REG_DWORD?Boolean
Valid Range: 0, 1 (False, True)
Default: 0 (False)
Description: This parameter controls access to raw sockets. If true, non - administrative users have access to raw sockets. By default, only administrators have access to raw sockets. For more information on raw sockets, see the Windows Sockets Specifications, available from ftp://ftp.microsoft.com/bussys/winsock/winsock2.

by syberdeath

raw sockets are a back door into things like internet explorer that allow info to come in to your computer untouched to do configure stuff. In windows 9x and I think NT and 2000 they can be either filtered or blocked to keep out hackers but in windows XP I dont think there is a way to keep hackers and malicious individuals from getting into your computer and doing pretty much anything they want.

That, of course, is the non-technical explanation. :)

by lechkung

Ok, so what are we talking about here (technically speaking, don't pull any punchs)? Is this the full tcp/ip stack that is on any unix machine? And is it such that any user can write a service to any port, including the first couple thousand ports(1-2000 ports are usually reserver for users that have root privileges)?

by maxwell edison

Well, there are several types of sockets: TCP and UDP go over the wire formatted as TCP or UDP packets, unix-domain sockets don't generally go over the wire (they're used for interprocess communication). These are some of the built-in socket types that the kernel understands (i.e. it will handle the connection management stuff at the front of each of these packet types). Raw sockets are used to generate/receive packets of a type that the kernel doesn't explicitly support.

An easy example that you're probably familiar with is PING. Ping works by sending out an ICMP (internet control message protocol - another IP protocol distinct from TCP or UDP) echo packet. The kernel has built-in code to respond to echo/ping packets; it has to in order to comply with the TCP/IP spec. It doesn't have code to generate these packets, because it isn't required. So, rather than create another system call with associated code in the kernel to accomplish this, the "ping packet generator" is a program in user space. It formats an ICMP echo packet and sends it out over a SOCK_RAW, waiting for a response. That's why ping runs as set-uid root.

This discussion is closed to new replies.