What is the best way to make TCP and UDP packet spoofing and injection?

Question

Hy folks,

I'm kinda new to low level networking. I need to intercepts all TCP/UDP packets and potentially filter or substitute them with new ones.

What would be the best way to intercept these packets and inject new one? I'm only targeting Windows platforms.

This belongs here if he wants to write a program that intercepts packets. If he's looking for a tool, it belongs on serverfault. — Andrioid, Jul 06 '09 at 13:33
Do you want to do this by using an existing tool/application which ha this functionality, or by writing your own device driver wich implements this? — ChrisW, Jul 06 '09 at 13:34

score 2 · Answer 1 · answered Jul 06 '09 at 13:34

2

You want WinPcap if you're on Windows. What you're going to need to do is intercept (and filter) packets with WinPcap and then write a program that does packet creation when/if you want it.

answered Jul 06 '09 at 13:34

Sam DeFabbia-Kane

2,599
17
11

I heard that WinPcap allows to capture packet, but does it allow injection too? – Lotfi Jul 06 '09 at 13:38
It doesn't, but the WinPcap about page lists a command-line utility (Nemesis) and an API (Libnet) for injection. – Sam DeFabbia-Kane Jul 06 '09 at 19:41

score 1 · Answer 2 · answered Jul 06 '09 at 13:31

1

Write a program that uses libpcap at TCPDump contains tons of API for messing with low-level networking

answered Jul 06 '09 at 13:31

Aiden Bell

28,212
4
75
119

score 1 · Answer 3 · edited May 23 '17 at 09:57

1

I want to develop a program, not just use a tool

This page has some references to other pages which introduce the network device driver architectures: NDIS Intermediate driver interface.

edited May 23 '17 at 09:57

Community

1
1

answered Jul 06 '09 at 13:44

ChrisW

54,973
13
116
224

score 0 · Answer 4 · answered Jul 06 '09 at 13:32

0

You can use tools like wireshark to intercept traffic.

If you planning to write a program which will do all this stuff , then you may need to go to driver level to intercept all traffic.

wireshark uses libpcap . I am not sure but that may help

answered Jul 06 '09 at 13:32

anand

11,071
28
101
159

What is the best way to make TCP and UDP packet spoofing and injection?

4 Answers4