패킷만들기

fragmentation overlap 공격에 사용할 패킷을 만들려고 합니다..
두번째 패킷의 오프셋을 변경하여 첫번째 패킷에 덮어쓰려고 하는데 이런 malformed packet을 만들려고 합니다..
아래의 소스에서 iphdr->offset 이런식으로 fragmentation과 관련된 부분을 추가하면 될까요..음..
제가 네트워크 프로그래밍 초보라서..
조언 부탁드립니다..

#include <stdlib.h>
#include <stdio.h>

#include <sys/types.h>
#include <sys/socket.h>

#include <netinet/in.h>
#include <arpa/inet.h>

#include <netinet/in_systm.h>
#include <netinet/ip.h>
#include <netinet/ip_icmp.h>

#if defined(SOLARIS_CKSUM_BUG)
#include <netinet/tcp.h>
#endif

#include <strings.h>
#include <unistd.h>

#if !defined(HAVE_INCKSUM)
#include <checksum.h>
#endif

#if !defined(IPVERSION)
#define IPVERSION 4  /* Incase some system does not have this definition. */
#endif               /* We'll always be using 4 as the version anyway. */

#if !defined(LINUX)
#define BUFFSIZE (sizeof(struct icmp) + sizeof(struct ip))
#else
#define BUFFSIZE (sizeof(struct icmphdr) + sizeof(struct iphdr))
#endif

int main(int argc,char *argv[])
{
#if !defined (LINUX)
  struct icmp *icmphdr;
  struct ip *iphdr;
#else
  struct icmphdr *icmphdr;
  struct iphdr *iphdr;
#endif
  unsigned char buff[BUFFSIZE];
  int sockd;
  struct sockaddr_in mysocket;
  int on = 1;
 
 if(argc < 3) {
   fprintf(stderr,"usage: %s source-ip dest-ip\n",argv[0]);
   exit(-1);
 }
  if((sockd = socket(AF_INET,SOCK_RAW,IPPROTO_RAW)) < 0)  {
    perror("socket");
    exit(-1);
  }
  
  if(setsockopt(sockd,IPPROTO_IP,IP_HDRINCL,(char *)&on,sizeof(on)) < 0)  {
    perror("setsockopt");
    exit(-1);
  }

#if !defined(LINUX)
  iphdr = (struct ip *)buff;
  bzero((char *)iphdr,sizeof(struct ip));
  
  iphdr->ip_hl = 5;
  iphdr->ip_v = IPVERSION;

#ifdef IP_LEN_HORDER
  iphdr->ip_len = (sizeof(struct ip) + sizeof(struct icmp));
#else
  iphdr->ip_len = htons(sizeof(struct ip) + sizeof(struct icmp));
#endif

  iphdr->ip_id = htons(getpid());
  iphdr->ip_ttl = 60;
  iphdr->ip_p = IPPROTO_ICMP;

  iphdr->ip_src.s_addr = inet_addr(argv[1]);
  iphdr->ip_dst.s_addr = inet_addr(argv[2]);
  
  iphdr->ip_sum = (unsigned short)in_cksum((unsigned short *)iphdr,
					   sizeof(struct ip));
  
  icmphdr = (struct icmp *)(buff + sizeof(struct ip));
  bzero((char *)icmphdr,sizeof(struct icmp));
  
  icmphdr->icmp_type = ICMP_ECHO;
  icmphdr->icmp_seq = getpid();
  icmphdr->icmp_id = getpid();

  icmphdr->icmp_cksum = in_cksum((unsigned short *)icmphdr,sizeof(struct icmp));

#else
  iphdr = (struct iphdr *)buff;
  bzero((char *)iphdr,sizeof(struct iphdr));
  
  iphdr->ihl = 5;
  iphdr->version = IPVERSION;
    
#ifdef IP_LEN_HORDER
  iphdr->tot_len = (sizeof(struct iphdr) + sizeof(struct icmphdr));
#else
  iphdr->tot_len = htons(sizeof(struct iphdr) + sizeof(struct icmphdr));
#endif
  
  iphdr->id = htons(getpid());
  iphdr->ttl = 60;
  iphdr->protocol = IPPROTO_ICMP;

  iphdr->saddr = inet_addr(argv[1]);
  iphdr->daddr = inet_addr(argv[2]);

  iphdr->check = in_cksum((unsigned short *)iphdr,sizeof(struct iphdr));
  
  icmphdr = (struct icmphdr *)(buff +sizeof(struct iphdr));
  bzero((char *)icmphdr,sizeof(struct icmphdr));
  
  icmphdr->type = ICMP_ECHO;
  icmphdr->un.echo.sequence = getpid();
  icmphdr->un.echo.id =  getpid();
  
  icmphdr->checksum = in_cksum((unsigned short *)icmphdr,
				sizeof(struct icmphdr));
#endif /* LINUX */

  
  bzero((char *)&mysocket,sizeof(mysocket));
  
  mysocket.sin_family = AF_INET;
  mysocket.sin_addr.s_addr = inet_addr(argv[2]);
  
  if(sendto(sockd,(char *)buff,sizeof(buff),0x0,
	    (struct sockaddr *)&mysocket,sizeof(mysocket)) < 0)  {
    perror("sendto");
    exit(-1);
  }
  
 exit(0);
}