Home All Groups Group Topic Archive Search About

Sending raw sockets without administrative privileges?

Author
13 Sep 2005 6:58 AM
Christian Jacob
Although I already have an own implementation for pinging remote hosts, I
encountered problems which I hoped others may have already solved.

The thing is, that all sources I found (including my own) use raw sockets to
send ICMP echo requests. A user without administrative privileges does not
have the permissions to create raw sockets though. This is why it simply does
not work with user permissions. Here is an example from Microsoft:
http://support.microsoft.com/kb/828993/en-us

I thought maybe the SocketPermission class might help. But it seems that it
is only capable of allowing TCP and UDP connections, not ICMP.

Does anyone have a solution for this?

Best regards,
Christian Jacob.

Author
13 Sep 2005 7:56 AM
Dominick Baier [DevelopMentor]
Hello Christian Jacob cjacob AT nospam toptechnologies DOT de,

under which operating system are you running? I am surprised that this works
at all, as sending raw sockets on XP SP2 and W2K3 SP1 should be disabled
by now (but maybe not for ICMP...)

SocketPermission is a Code Access Security class and has nothing to do with
OS level privileges.

If you can upgrade to .NET 2.0 - there is an easy solution :)

using System.Net.NetworkInformation;

PingReply reply = new Ping().Send(args[0]);
Console.WriteLine("Reply from {0} - Roundtrip Time {1} ms", reply.Address,
reply.RoundTripTime);


---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote
> Although I already have an own implementation for pinging remote
> hosts, I encountered problems which I hoped others may have already
> solved.
>
> The thing is, that all sources I found (including my own) use raw
> sockets to send ICMP echo requests. A user without administrative
> privileges does not have the permissions to create raw sockets though.
> This is why it simply does not work with user permissions. Here is an
> example from Microsoft: http://support.microsoft.com/kb/828993/en-us
>
> I thought maybe the SocketPermission class might help. But it seems
> that it is only capable of allowing TCP and UDP connections, not ICMP.
>
> Does anyone have a solution for this?
>
> Best regards,
> Christian Jacob.
Author
13 Sep 2005 8:11 AM
Christian Jacob
Hi Dominick,

yes, I am actually using Windows XP SP2. I know, that .NET 2 brings a
solution (I was wondering all the time, why 1.1 didnt include a ping class,
e.g.), but unfortunately, I cannot upgrade (yet) for several reasons.

1. The ping class is used in a component of a software which is distributed
to customers and we cannot force them to upgrade to 2.0

2. 2.0 is still in beta. ;-)

Anyway,... so you say, there is no way of pinging another computer safely
without running into permission problems?

Since we use the ICMP echo request for testing whether a host is "alive", is
there another convenient way for getting this piece of information? I read
about establishing a TCP connect,... is this a common and reliable way?

Best regards,
Christian.


Show quoteHide quote
"Dominick Baier [DevelopMentor]" wrote:

> Hello Christian Jacob cjacob AT nospam toptechnologies DOT de,
>
> under which operating system are you running? I am surprised that this works
> at all, as sending raw sockets on XP SP2 and W2K3 SP1 should be disabled
> by now (but maybe not for ICMP...)
>
> SocketPermission is a Code Access Security class and has nothing to do with
> OS level privileges.
>
> If you can upgrade to .NET 2.0 - there is an easy solution :)
>
> using System.Net.NetworkInformation;
>
> PingReply reply = new Ping().Send(args[0]);
> Console.WriteLine("Reply from {0} - Roundtrip Time {1} ms", reply.Address,
> reply.RoundTripTime);
>
>
> ---------------------------------------
> Dominick Baier - DevelopMentor
> http://www.leastprivilege.com
>
> > Although I already have an own implementation for pinging remote
> > hosts, I encountered problems which I hoped others may have already
> > solved.
> >
> > The thing is, that all sources I found (including my own) use raw
> > sockets to send ICMP echo requests. A user without administrative
> > privileges does not have the permissions to create raw sockets though.
> > This is why it simply does not work with user permissions. Here is an
> > example from Microsoft: http://support.microsoft.com/kb/828993/en-us
> >
> > I thought maybe the SocketPermission class might help. But it seems
> > that it is only capable of allowing TCP and UDP connections, not ICMP.
> >
> > Does anyone have a solution for this?
> >
> > Best regards,
> > Christian Jacob.
>
>
>
Author
13 Sep 2005 8:47 AM
Dominick Baier [DevelopMentor]
Hello Christian Jacob cjacob AT nospam toptechnologies DOT de,

to what do you want to do a TCP connect??

I know this is very "hackish" - how about spawning ping.exe and harversting
the console out results??
IIRC, WMI also provides ways of pinging - but i am not sure in which namespace
exactly, and also not about the required privileges to do that (maybe have
a look at the WMI SDK on MSDN)

---------------------------------------
Dominick Baier - DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote
> Hi Dominick,
>
> yes, I am actually using Windows XP SP2. I know, that .NET 2 brings a
> solution (I was wondering all the time, why 1.1 didnt include a ping
> class, e.g.), but unfortunately, I cannot upgrade (yet) for several
> reasons.
>
> 1. The ping class is used in a component of a software which is
> distributed to customers and we cannot force them to upgrade to 2.0
>
> 2. 2.0 is still in beta. ;-)
>
> Anyway,... so you say, there is no way of pinging another computer
> safely without running into permission problems?
>
> Since we use the ICMP echo request for testing whether a host is
> "alive", is there another convenient way for getting this piece of
> information? I read about establishing a TCP connect,... is this a
> common and reliable way?
>
> Best regards,
> Christian.
> "Dominick Baier [DevelopMentor]" wrote:
>
>> Hello Christian Jacob cjacob AT nospam toptechnologies DOT de,
>>
>> under which operating system are you running? I am surprised that
>> this works at all, as sending raw sockets on XP SP2 and W2K3 SP1
>> should be disabled by now (but maybe not for ICMP...)
>>
>> SocketPermission is a Code Access Security class and has nothing to
>> do with OS level privileges.
>>
>> If you can upgrade to .NET 2.0 - there is an easy solution :)
>>
>> using System.Net.NetworkInformation;
>>
>> PingReply reply = new Ping().Send(args[0]);
>> Console.WriteLine("Reply from {0} - Roundtrip Time {1} ms",
>> reply.Address,
>> reply.RoundTripTime);
>> ---------------------------------------
>> Dominick Baier - DevelopMentor
>> http://www.leastprivilege.com
>>> Although I already have an own implementation for pinging remote
>>> hosts, I encountered problems which I hoped others may have already
>>> solved.
>>>
>>> The thing is, that all sources I found (including my own) use raw
>>> sockets to send ICMP echo requests. A user without administrative
>>> privileges does not have the permissions to create raw sockets
>>> though. This is why it simply does not work with user permissions.
>>> Here is an example from Microsoft:
>>> http://support.microsoft.com/kb/828993/en-us
>>>
>>> I thought maybe the SocketPermission class might help. But it seems
>>> that it is only capable of allowing TCP and UDP connections, not
>>> ICMP.
>>>
>>> Does anyone have a solution for this?
>>>
>>> Best regards,
>>> Christian Jacob.
Author
13 Sep 2005 1:26 PM
William Stacey [MVP]
There is a ICMP api in win32.  There are c# and vb examples of using it out
there.
http://www.pinvoke.net/default.aspx/icmp/IcmpSendEcho.html

--
William Stacey [MVP]

Show quoteHide quote
"Christian Jacob" <cjacob AT nospam toptechnologies DOT de> wrote in message
news:5EDFF1A4-1F39-4AC8-A812-4E21B9DAC5A5@microsoft.com...
> Hi Dominick,
>
> yes, I am actually using Windows XP SP2. I know, that .NET 2 brings a
> solution (I was wondering all the time, why 1.1 didnt include a ping
> class,
> e.g.), but unfortunately, I cannot upgrade (yet) for several reasons.
>
> 1. The ping class is used in a component of a software which is
> distributed
> to customers and we cannot force them to upgrade to 2.0
>
> 2. 2.0 is still in beta. ;-)
>
> Anyway,... so you say, there is no way of pinging another computer safely
> without running into permission problems?
>
> Since we use the ICMP echo request for testing whether a host is "alive",
> is
> there another convenient way for getting this piece of information? I read
> about establishing a TCP connect,... is this a common and reliable way?
>
> Best regards,
> Christian.
>
>
> "Dominick Baier [DevelopMentor]" wrote:
>
>> Hello Christian Jacob cjacob AT nospam toptechnologies DOT de,
>>
>> under which operating system are you running? I am surprised that this
>> works
>> at all, as sending raw sockets on XP SP2 and W2K3 SP1 should be disabled
>> by now (but maybe not for ICMP...)
>>
>> SocketPermission is a Code Access Security class and has nothing to do
>> with
>> OS level privileges.
>>
>> If you can upgrade to .NET 2.0 - there is an easy solution :)
>>
>> using System.Net.NetworkInformation;
>>
>> PingReply reply = new Ping().Send(args[0]);
>> Console.WriteLine("Reply from {0} - Roundtrip Time {1} ms",
>> reply.Address,
>> reply.RoundTripTime);
>>
>>
>> ---------------------------------------
>> Dominick Baier - DevelopMentor
>> http://www.leastprivilege.com
>>
>> > Although I already have an own implementation for pinging remote
>> > hosts, I encountered problems which I hoped others may have already
>> > solved.
>> >
>> > The thing is, that all sources I found (including my own) use raw
>> > sockets to send ICMP echo requests. A user without administrative
>> > privileges does not have the permissions to create raw sockets though.
>> > This is why it simply does not work with user permissions. Here is an
>> > example from Microsoft: http://support.microsoft.com/kb/828993/en-us
>> >
>> > I thought maybe the SocketPermission class might help. But it seems
>> > that it is only capable of allowing TCP and UDP connections, not ICMP.
>> >
>> > Does anyone have a solution for this?
>> >
>> > Best regards,
>> > Christian Jacob.
>>
>>
>>