CASE 4 is similar to CASE 3 but it always uses the same destination IP address: In this example "102.10.0.0". When sending: (0x2)abcdef bash-2.04# strace -f reverse/the-binary4 execve("reverse/the-binary4", ["reverse/the-binary4"], [/* 35 vars */]) = 0 personality(PER_LINUX) = 0 geteuid() = 0 sigaction(SIGCHLD, {SIG_IGN}, {SIG_DFL}, 0x4006b008) = 0 setsid() = 1651 sigaction(SIGCHLD, {SIG_IGN}, {SIG_IGN}, 0x80575a8) = 0 chdir("/") = 0 close(0) = 0 close(1) = 0 close(2) = 0 time(NULL) = 1022196221 socket(PF_INET, SOCK_RAW, 0xb /* IPPROTO_??? */) = 0 sigaction(SIGHUP, {SIG_IGN}, {SIG_DFL}, 0x4006b008) = 0 sigaction(SIGTERM, {SIG_IGN}, {SIG_DFL}, 0x4006b008) = 0 sigaction(SIGCHLD, {SIG_IGN}, {SIG_IGN}, 0x80575a8) = 0 sigaction(SIGCHLD, {SIG_IGN}, {SIG_IGN}, 0x80575a8) = 0 recv(0, "E\0\5\334\26\301@\0@\v\231\370\300\250\1\17\300\250\1\376"..., 2048, 0) = 1500 socket(PF_INET, SOCK_RAW, IPPROTO_RAW) = 1 sendto(1, "E\0(\34\4U\37\376\234\21lt\0\0\0\0f\n\0\0\0\30\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("102.10.0.0")}}, 16) = -1 ENETUNREACH (Network is unreachable) sendto(1, "E\0(\34\4U\37\376\234\21lt\0\0\0\0f\n\0\0\0\30\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("102.10.0.0")}}, 16) = -1 ENETUNREACH (Network is unreachable) oldselect(1, NULL, NULL, NULL, {0, 20}) = 0 (Timeout) sendto(1, "E\0(\34\4U\37\376\234\21lt\0\0\0\0f\n\0\0\0\30\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("102.10.0.0")}}, 16) = -1 ENETUNREACH (Network is unreachable) sendto(1, "E\0(\34\4U\37\376\234\21lt\0\0\0\0f\n\0\0\0\30\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("102.10.0.0")}}, 16) = -1 ENETUNREACH (Network is unreachable) oldselect(1, NULL, NULL, NULL, {0, 20}) = 0 (Timeout) sendto(1, "E\0(\34\4U\37\376\234\21lt\0\0\0\0f\n\0\0\0\30\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("102.10.0.0")}}, 16) = -1 ENETUNREACH (Network is unreachable) sendto(1, "E\0(\34\4U\37\376\234\21lt\0\0\0\0f\n\0\0\0\30\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("102.10.0.0")}}, 16) = -1 ENETUNREACH (Network is unreachable) oldselect(1, NULL, NULL, NULL, {0, 20}) = 0 (Timeout) sendto(1, "E\0(\34\4U\37\376\234\21lt\0\0\0\0f\n\0\0\0\30\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(222), sin_addr=inet_addr("102.10.0.0")}}, 16) = -1 ENETUNREACH (Network is unreachable) ... If you send a different data information: (0x2)abcfedghi , you get a different destination address, so you can select it based on the data input: sendto(1, "E\0(\34\4U\37\376\222\21\5\256\n\0\0\0dghi\0\213\0e\0\t"..., 29, 0, {sin_family=AF_INET, sin_port=htons(174), sin_addr=inet_addr("100.103.104.105")}}, 16) = -1 ENETUNREACH (Network is unreachable) The destination IP address is not based in the data input leght but in the information sent, the contents. Some examples showing how the destination IP address changes based on the data input: (0x2)abcd sendto(1, "E\0(\34\4U\37\376\224\21\332~\0\0\0\0\0\0\0\0\0\236\0\n"..., 29, 0, {sin_family=AF_INET, sin_port=htons(165), sin_addr=inet_addr("0.0.0.0")}}, 16) = 29 (0x2)abcde sendto(1, "E\0(\34\4U\37\376\221\21\323~\0\0\0\0\n\0\0\0\0-\0e\0\t"..., 29, 0, {sin_family=AF_INET, sin_port=htons(119), sin_addr=inet_addr("10.0.0.0")}}, 16) = 29 (0x2)abcdef sendto(1, "E\0(\34\4U\37\376\342\21&t\0\0\0\0f\n\0\0\0F\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(182), sin_addr=inet_addr("102.10.0.0")}}, 16) = 29 As can be seen, the 5th byte sent (for example, in "abcde", the "e"), is the first element taken to build the destination IP address. But it just forces a "10" value in the address. The next char is the following octect in the IP address and so on: (0x2)abcdefg sendto(1, "E\0(\34\4U\37\376\207\21w\27\0\0\0\0fg\n\0\0I\0e\0\t\377"..., 29, 0, {sin_family=AF_INET, sin_port=htons(26), sin_addr=inet_addr("102.103.10.0")}}, 16) = 29 (0x2)abcdefgh sendto(1, "E\0(\34\4U\37\376\203\21\35\r\0\0\0\0fgh\n\0\372\0e\0\t"..., 29, 0, {sin_family=AF_INET, sin_port=htons(120), sin_addr=inet_addr("102.103.104.10")}}, 16) = 29 (0x2)abcdefghi sendto(1, "E\0(\34\4U\37\376\323\21\302\255\n\0\0\0fghi\0\363\0e\0"..., 29, 0, {sin_family=AF_INET, sin_port=htons(174), sin_addr=inet_addr("102.103.104.105")}}, 16) = 29 (0x2)abcdefghij sendto(1, "E\0(\34\4U\37\376\244\21\221\243j\n\0\0fghi\0005\0e\0\t"..., 29, 0, {sin_family=AF_INET, sin_port=htons(192), sin_addr=inet_addr("102.103.104.105")}}, 16) = 29 Its the same as the previous one, so only the 4 bytes 6,7,8,9 define the destination IP address. If you miss some of the characters, it places a "10" value instead, followed by "0" values.