PacketForge

A userspace L2/L3 network stack implementation in modern C++ (C++20). This tool bypasses the standard OS network stack by using raw sockets (AF_PACKET) to manually craft, send, and receive network frames.

Features

• Raw Socket Integration: Uses AF_PACKET to interact directly with the network interface.
• Manual Header Crafting: Custom implementations of Ethernet, IPv4, ICMP, and ARP headers.
• Internet Checksum: RFC 1071 compliant checksum calculation.
• ARP Discovery: Manually send ARP requests and parse replies.
• Raw Ping: A ping utility built from scratch using ICMP Echo Requests over raw Ethernet frames.

Architecture

The project is structured into modular components:

• include/protocol_headers.hpp: Defines the binary layout of network headers using packed structs and bit-fields.
• include/raw_socket.hpp: Manages the lifecycle of the AF_PACKET socket, including interface binding and timeout-based reception.
• include/utils.hpp: Contains helper functions for checksums and MAC address parsing.
• src/main.cpp: Implements the command-line interface and the logic for ARP and Ping modes.

How to Run

Prerequisites

• Linux environment.
• C++20 compiler (e.g., GCC 10+).
• Root privileges (required for raw socket access).

Build

make

Usage

The utility requires an interface name (e.g., eth0), a mode (arp or ping), and the target parameters.

1. ARP Discovery

To find the MAC address of a target IP:

sudo ./bin/packetforge <interface> arp <target_ip>

Example:

sudo ./bin/packetforge eth0 arp 172.30.0.1

2. Raw Ping

To ping a target IP (requires the target MAC address, which you can get from the ARP mode):

sudo ./bin/packetforge <interface> ping <target_ip> <target_mac>

Example:

sudo ./bin/packetforge eth0 ping 172.30.0.1 00:15:5d:3c:fa:96

Technical Details

• Socket Type: socket(AF_PACKET, SOCK_RAW, htons(ETH_P_ALL))
• Language: C++20
• System Calls: socket, ioctl, bind, sendto, recvfrom, poll.
• Memory Management: Zero-copy where possible using reinterpret_cast on pre-allocated buffers.