netcat | NetCat for Windows | Security Testing library

I tried to simplify my problem with the following setup.

• A simple netcat UDP listener on Port 1337 on my local interface (192.168.183.130)
• A simple netcat UDP client connecting to the listener on port 1337 (from 192.168.183.128)
• A very basic scapy sniffer running on 192.168.183.130

Scapy sniffer running with root privileges:

The code below is my attempt at a minimal cross-platform echo server in C++. It does what I expect, except for a platform-dependent asymmetry in the way IP backward-compatibility is handled: on Windows, unlike the other two platforms I've tried, an IPv6 server fails to handle requests from IPv4 clients.^*

To me the fact that the other platforms can do this (result #3 below) was an unexpected but very welcome win. It opens up some possibilities for me, provided I can get it to work on Windows too. So my questions are: is it expected that the same thing fails on Windows (compare results #3 and #5)? And is there something I can do with the server code to get #5 to succeed?

It breaks down as follows:

Server uses IPv4 (minimal_echo_server 8081 4):

1. client uses IPv4 address: server responds as expected
2. client uses IPv6 address: connection fails^** as expected

Server uses IPv6 on Ubuntu 20.04 or macOS 10.13 (./minimal_echo_server 8081 6):

1. client uses IPv4 address: server responds just fine (renders the client's IP as ::ffff: followed by an IPv4 address)
2. client uses IPv6 address: server responds as expected

Server uses IPv6 on Windows 10 (.\minimal_echo_server.exe 8081 6):

1. client uses IPv4 address: connection fails^**
2. client uses IPv6 address: server responds as expected

^* An example of what I mean by "IPv4 client" might be the following netcat call:

I am using Docker Desktop for Mac.

Since version 3.3.0 and with 3.3.1 I cannot connect to altssh.gitlab.com on port 443 any more whereas 3.2.2 and earlier work.

So, these commands both work in 3.2.2 (I downgraded and verified):

Here's my code, I'd like to focus on the call to WSARecv and WSAGetOverlappedResult:

I have a script that I want to run using a dockerfile that looks like this:

So i have a script that sends data over a TCP connection with netcat which is working well.

What I would like to do is receive the data sent back by the server, and on a specific response, do an action.

The problem I have is that I don't know how to extract the full data package sent to me.

For example, the server sends me the following data (caught on wireshark):

I am creating an instance from a sourceImage, using this terraform template:

Context

I have spiked a TCP Echo server and am trying to write integration tests for it. I'm familiar with testing but not asynchronously.

Desired Behaviour

I would like my tests to spy on logs to verify that the code is being executed. Any asynchronous code should be handled properly, but this is where my understanding falls through.

Problem

I am getting asynchronous errors:

Cannot log after tests are done. Did you forget to wait for something async in your test? Attempted to log "Server Ready". Attempted to log "Client Connected".

And finally a warning:

A worker process has failed to exit gracefully and has been force exited. This is likely caused by tests leaking due to improper teardown. Try running with --detectOpenHandles to find leaks.

Code

I have a pcap file that I modified with tcprewrite to set source and destination IP = 127.0.0.1, while the port numbers are different. I also set both mac addresses to 00:00:00:00:00:00 as I understand that comms over localhost ignore MAC. I made sure checksum was fixed.

When I run tcpreplay -i lo test-lo.pcap in one shell, and tcpdump -i lo -p udp port 50001 in another, I see the traffic. Yet, when I try to view the traffic with netcat -l -u 50001, it sees nothing. Wireshark is capturing the traffic correctly.

Side note: I'm seeing the following warning when running tcpreplay on localhost: Warning: Unsupported physical layer type 0x0304 on lo. Maybe it works, maybe it won't. See tickets #123/318 That seems worrisome.

I'm asking because my own UDP listener code is also having the same problem as netcat and thought that maybe I'm missing something. Why would traffic be seen by tcpdump and wireshark, and not by netcat?