TCP ACK spoofing

Question

I am writing a program that fakes TCP requests and collects the data to store in a local buffer. For this, in the system connected to the client i have configured the iptables to keep all the incoming packets to a queue before routing. Then i use the netfilter library to read the packets from the queue. After this using RAW sockets I send the fake TCP packets to the client. With this I am able to fake the SYN/ACK packet in response to the SYN request from the client.

But issue happens when I try to fake an ACK to the client in response to the incoming data. In this case the real ip of the source comes in the packet and not the faked one. Please see 7th trace below marked with ">>>". In this the source ip is shown as 192.168.10.10 where as it has to be 212.58.246.81. In the 4th trace(i.e. SYN/ACK packet) its showing as fine.

3  0.073852000  192.168.10.100  212.58.246.81  TCP  38307 > http [SYN] Seq=0 Win=5840 Len=0 MSS=1460 TSV=502233100 TSER=0 WS=6
4  0.103102000  212.58.246.81  192.168.10.100  TCP  http > 38307 [SYN, ACK] Seq=0 Ack=1 Win=31744 Len=0
5  0.103147000  192.168.10.100  212.58.246.81  TCP  38307 > http [ACK] Seq=1 Ack=1 Win=5840 Len=0
6  0.103349000  192.168.10.100  212.58.246.81  HTTP  GET /go/rss/int/news/-/sport2/hi/tennis/9519762.stm HTTP/1.1
>>> 7  1.118729000  192.168.10.10  192.168.10.100  TCP  http > 38307 [ACK] Seq=1 Ack=1 Win=31744 Len=0
8  1.118788000  192.168.10.100  192.168.10.10  TCP  38307 > http [RST] Seq=1 Win=0 Len=0
9  3.102627000  192.168.10.100  212.58.246.81  HTTP  [TCP Retransmission] GET /go/rss/int/news/-/sport2/hi/tennis/9519762.stm HTTP/1.1
10  3.148590000  192.168.10.10  192.168.10.100  TCP  [TCP Dup ACK 7#1] http > 38307 [ACK] Seq=1 Ack=1 Win=31744 Len=0
11  3.148606000  192.168.10.100  192.168.10.10  TCP  38307 > http [RST] Seq=1 Win=0 Len=0

Also I have tried out "sendip" command like below to send a fake TCP ACK

sendip -p ipv4 -p tcp -is 212.58.246.81 -id 192.168.10.100 -ts 80 -td 4567 -tfa 1 -tfs 0 -d "Data" 192.168.10.100

here tfa and tfs stands for ack and syn flags respectively. This also didnt work as expected and its shown as orginating from 192.168.10.10 instead of 212.58.246.81. But if I set both flags(syn and ack) as 1 then its working fine.

The OS is Ubuntu. Can anyone please let me know where I am going wrong. Thanks a lot for your help.

Bipartite

What problem are you solving by faking acks to an http client? – Yearlong

I am trying to split the end to end TCP connection to multiple conntections. One is split like above, and the data and connection details will be stored in a buffer. Then use another transport protocol like SCTP to transfer the data and connection details to another machine and finally this machine opens a TCP connection to the real webserver and gets the data and sends back. Kind of below TCP <---> SCTP <--> TCP – Bipartite

I am not sure if its the ip identification field thats causing the issue. An extract from wikipedia, "Some experimental work has suggested using the ID field for other purposes, such as for adding packet-tracing information to datagrams in order to help trace back datagrams with spoofed source addresses" – Bipartite

How does proxying through SCTP solve a problem? What language did you write your code in? – Yearlong

We have a high latency channel(shortwave radio link) over which SCTP is planned to be used, as its better than TCP(hopefully :))...the program is written in C.. – Bipartite