Send ICMP Echo Replies using eBPF
The code parses the passed network packet into its Ethernet, IP and ICMP header,
swaps addresses (MAC and IP addresses), changes the ICMP type to
ICMP Echo Reply,
re-calculates the ICMP checksum and sends the modified packet back out over the same interface.
- A recent kernel. Tested with 4.8 and 4.9
iproute2 v4.9. v4.10 has a bug makig it unusable. If your system does not provide it, compile it from git. Installation is not needed, the
tcbinary is enough.
>= 3.8. eBPF backend required.
Code was tested on Ubuntu 16.10 with self-compiled iproute2 v4.9 and clang 4.0.
First create a qdisc, then attach the classification and action, and at last show logging information:
make bpf.o make qdisc make run make show exec
Delete filters and qdiscs afterwards:
make delete make qdisc-delete
The code in
bpf.c is commented to explain each step.