Recently I've came across IOU leakage topic on evilrouter site. Being delighted how light it was comparing to dynamips, I realized that it lacks real network connectivity. While tracing and looking at IOU internals I found out, that iou instances exchange with each other through unix sockets in /tmp/netioY/X where X is IOU id. i.e.
./i86bi_linux-adventerprisek9-ms X
and Y is UID.
Assuming IOU is linux (unix) port of IOS with some stubs, I wrote small C application that sniffs traffic exchange. I think it's possible to retransmit it to the real network (connect to real switches etc) by extracting from local socket and then using AF_PACKET and bridge utils on Linux.
I wonder if someone wants to research this topic too that is why I made this blog.
There is what local traffic exchange looks like. This is arp request packet from aabb.cc00.2a10.
0x0 0x2c 0x0 0x2a 0x10 0x10 0x1 0x0 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffff 0xffffffaa 0xffffffbb 0xffffffcc 0x0 0x2a 0x10 0x8 0x6 0x0 0x1 0x8 0x0 0x6 0x4 0x0 0x1 0xffffffaa 0xffffffbb 0xffffffcc 0x0 0x2a 0x10 0xa 0xa 0xa 0xb 0x0 0x0 0x0 0x0 0x0 0x0 0xa 0xa 0xa 0x64 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0
0x00 0x2C - dst local socket number /tmp/netio0/44, dst IOU ID
0x00 0x2A - src IOU ID
0x10 - dst interface id inside iou
0x10 - src interface id inside iou
0x01 0x00 - unknown so far
and then arp header follows...
I also provide like to download unlocked iou (hope it draw people).
Very slow, but just in case...
h44p://93.92.219.66:5081/i86bi_linux-adventerprisek9-ms
h44p://93.92.219.66:5081/wrapper-linux
