packet data intercept and modification

Question

I'd like to be able to intercept/ modify data in tcp flow, on the side of tcp client. Examples for pcap show how to parse tcp packet header/ payload. But suppose, i want to modify packet payload before tcp client reads it, or drop the packet entirely. How can i do that with pcap capure?

Answer 1

Scapy used in conjunction with python is a very good tool cum library.

You can do all sorts of packet monitoring and editing via command line

Also you can build applications on top of scapy to do a specific task.

Scapy

Answer 2

As above, you can't do interception/modification with pcap. For this you need one of the following OS-dependent techniques:

• Linux: libnetfilter_queue + iptables
• MacOS, FreeBSD: divert sockets + ipfw
• Windows: WinPkFilter (commercial), WinDivert (LGPL), or write your own NDIS IM or WFP call-out driver.

(usual disclosure: WinDivert is my project).

Answer 3

You can't do that with libpcap or WinPcap; libpcap is built atop OS mechanisms that do not support that (those mechanisms exist to support passive packet capture and low-level packet capture and injection, not to support packet modification in the packet input and output path), and WinPcap's driver is built atop an OS mechanism of that sort.

You would have to find some mechanism, in whatever OS you're using, that supports tapping into the networking stack in a way that allows the tapping program to modify packets as they pass through the networking stack. Such a mechanism might not exist on some OSes; on OSes where it does exist, if there are any, it's probably very OS-dependent. (The mechanisms libpcap uses are also OS-dependent; libpcap exists, in part, to hide those differences from applications, to the maximum extend possible.)