NetworkAnalyzer

Send or capture any packet (sequence of bytes) on any interface desired.

Table of Contents

• NetworkAnalyzer
  • Table of Contents
  • Send raw packets
    • Example
  • Send TCP SYN packet
    • Example
  • Capture TCP SYN-ACK packets
    • Example
  • Scan open ports of a target
    • Example

Send raw packets

By using pkt_sender.py you can send any sequence of bytes through the chosen interface. If your interface uses ethernet protocol as the link layer protocol (it probably does), the packet should be at least 14 bytes.

If you want the packet to be a valid ethernet packet you must follow the ethernet frame format shown below.

#	Destination MAC Address	Source MAC Address	EtherType	Payload
Size	6 bytes	6 bytes	2 bytes	Up to 1500 bytes
Sample Format	F3054290A2C6	5E0781A2BB0D	0080

Using 80 as EthernetType means you want to use IP as the network layer.

You can list your interfaces with the command below:

$ ip link

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: wlp3s0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DORMANT group default qlen 1000
    link/ether 00:00:00:00:00:00 brd ff:ff:ff:ff:ff:ff

Example

Sending an packet without payload through the wlp3s0 interface:

$ sudo python3 pkt_sender.py

Content of your packet: F3054290A2C65E0781A2BB0D0080
Interface: wlp3s0
Sent 14-byte packet on wlp3s0

Send TCP SYN packet

You can use tcp_syn_sender.py to send TCP SYN packets. You should specify packet's information in info.txt like this:

Dest IP:                 93.184.216.34
Dest Port:               80
Src IP:                  192.168.200.221
Src Port:                3000
Interface:               wlp3s0
Interface's Mac Address: 70:66:55:c0:9f:53 
Gateway's Mac Address:   96:8d:38:93:ec:8b

You can run info.sh bash script to create this file for you.

$ chmod +x info.sh

# ./info.sh DestIP DestPort Interface SrcPort
$ ./info.sh 93.184.216.34 80 wlp3s0 3000

Example

By running tcp_syn_sender.py your packet will be sent

$ sudo python3 tcp_syn_sender.py

TCP SYN packet sent to 93.184.216.34:80 through wlp3s0

Capture TCP SYN-ACK packets

Wireshark is a packet sniffer and analysis tool. It captures network traffic on the local network and stores the data for analysis.

our miniwireshark is a special-purpose Wireshark, which captures all TCP SYN-ACK packets, our host is receiving.

Example

$ sudo python3 miniwireshark.py

Port 443 is open on 50.16.232.21
Port 80 is open on 93.184.216.34

Scan open ports of a target

Nmap is a network scanner to discover hosts and services on a computer network by sending packets and analyzing the responses.

mininmap.py and mininmap_tcp_socket.py are written to send TCP SYN packets to a range of ports of a target machine. mininmap.py sends TCP packets using raw socket, but mininmap_tcp_socket.py uses python's TCP socket and it's multi-threaded.

You can use mininmap combined with miniwireshark to scan target ports.

Example