Data Packet Replay

Data Packet Replay 0x00 Introduction

This article is about how to modify the data packet and the data packet replay some knowledge and the method. Mainly for the IPS and other "safe box" products, research and development engineers to test the use.

0x01 Data modification

Many parameters may need to be modified during the testing of the product. As for the details of the packet, this is not explained in detail here. We mainly introduce the methods and tools of packet modification.

With the software colasoft Packet Builder 1.0, you see that you can modify the contents of the packet, but the software modifies the mac , and the packet errors occur. The main reason here is that after Mac modification,checksum has not been modified. So if you want to continue using this method, you need to manually modify the checksum.

The tcprewrite is used here to make modifications.

Tcprewite installation, I was installed under centos6.5,tcprewite is tcpreplay A component under the. tcprewite command too much.

Here we use tcprewrite to continue to modify the various information of the packet, because our products in the testing process is only in transparent mode deployment, so only need to modify the mac, but also modified the next IP . A bash script is given here .

#!/bin/sh

2

3 sip=192.168.20.104

4 dip=203.11.20.33

5

6 dmac=00:0c:29:81:6c:06

7 Smac=44:37:e6:11:a7:b7

8

9 tcpprep-a client-i "$"-O Fix.cach

10

Tcprewrite--endpoints= $sip: $dip--cachefile=fix.cach--infile= "$"--ou tfile=fix.pcap--skipbroadcast

12

Tcprewrite--enet-dmac= $dmac--enet_smac= $smac--infile=fix.pcap--outfi le= "$1_new.pcap"

The above is to modify the IP and mac addresses. Notice to change the IPfirst, then change the mac.

0x02 Packet replay

With the colasoft Packet Builder 1.0 , a single package can be played,andtcpreplay can also be used to perform the function of the packet playback, but only at the command line. This section describes the packet player.

Originally wanted to modify the mac and IP, and analyze checksum and modify checksum code put it up , see something else, wait for me to re-change after the generation program again hair. The actual network penetration experience is insufficient, which friend wants to make a friend,QQ:646878467. The technical content of this article is not high, but there is a large demand for such methods, there is a need to reference.

Data Packet Replay