Netcat sends optional "X" UDP packets

Question

Theft from here I installed a small Python script that listens on a port and prints out all the UDP packets it receives

import socket UDP_IP = "127.0.0.1" UDP_PORT = 5005 sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) sock.bind((UDP_IP, UDP_PORT)) while True: data, addr = sock.recvfrom(1024) print "received message:", repr(data) 

Now I use netcat to send data to this script. Here is my command line.

 echo -e "foo:1|c" | netcat -v -u localhost 5005 

And here is the output from Python:

 received message: 'X' received message: 'X' received message: 'X' received message: 'X' received message: 'X' received message: 'foo:1|c\n' 

These first four or so lines of "X" reach approximately one second intervals, then the last two lines arrive at approximately the same time.

My question is: where are these extra “X” packages, and if the source is netcat , then how can I prevent netcat from emitting them? In my opinion, this is BSD netcat .

Answer 1

This is a BSD netcat, I suppose.

I had the same problem, and when I did nc --version , I really saw:

This is nc from the netcat-openbsd package. Alternative nc is available in the traditional netcat package.

The traditional wisdom is that BSD is the “best” version (see What are the differences between netcat-traditional and netcat-openbsd? )

But anyway, BSD sources are where you need to look to find the appropriate code where the "X" happens. And you don’t need to look too much!

http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.bin/nc/netcat.c?rev=1.177

A smoking gun is the udptest() function:

 /* * udptest() * Do a few writes to see if the UDP port is there. * Fails once PF state table is full. */ int udptest(int s) { int i, ret; for (i = 0; i <= 3; i++) { if (write(s, "X", 1) == 1) ret = 1; else ret = -1; } return (ret); } 

And the conditions under which this is caused are if vflag (Verbosity) or zflag (port scan flag):

 if (vflag || zflag) { /* For UDP, make sure we are connected. */ if (uflag) { if (udptest(s) == -1) { ret = 1; continue; } } ... 

Regarding the rationale for why the -v switch will start throwing random data on a UDP port, I would suggest that those using -v want to get every bit of the information they can get. Thus, the tradeoff between receiving a start message and a voice connection message is worth helping someone in a debugging situation.

But even in this case, my opinion will be that instead of sending the mysterious "X" , sending something like "NETCAT UDP PING DUE TO -V OPTION" would be better .: - /

Answer 2

For reasons that I cannot determine, these X packets are sent using the -v to nc . Try instead:

 echo -e "foo:1|c" | netcat -u localhost 5005 

Answer 3

Use echo -n "foo:1|c" > /dev/udp/localhost/5005