abcip is a simple packet crafting tool. It is intended to be easy to generate pcaps for testing, especially pcaps containing flawed packets.
To get started after cloning the repo, do this:
./bootstrap
./configure
make
make install
You can also ./configure --enable-daq to produce a DAQ that can be used with Snort. Use --with-daq-includes=/path/to/daq/include if needed.
To run it, do this:
abcip [options] < abc-file
Options are:
--help or -? to get this help
--help-a or -?a to get a list of a|b protocol options
--help-b or -?b to get a list of a|b protocol options
--help-c or -?c to get a list of c statement options
--help-d or -?d to get a list of d statement options
--help-bind to get a list of available protocol bindings
--help-config same as --help-c
--help-data to dump the default stream data
--help-define same as --help-d
--help-packet same as --help-a and --help-b
--help-protos to get a list of supported protocols
--help-users to get a list of supported users
--license outputs license information
--pcap <file> writes each packet to the given pcap file
--raw changes input to just payload data (no commands)
--snap <len=65535> set pcap snaplen
--stack <protos=eth:ip4:tcp> sets default encapsulations
--trace outputs a text summary of each packet
--user <type=user> sets default user type
--full-monty to use original scene V default stream data
--full-dubya to use obfuscated scene V default stream data
--version outputs version information
abcip returns 0 for success or -1 for error reading abc file. See the README for more information on the abc file.
Here is a an example abc file:
# define the stack
d ( stack="eth:ip4:tcp" )
# configure tcp ports
c ( 4:a=12345, b=80 )
# generate a packet from a to b
a ( syn )
# generate a packet from a to b
b ( syn, ack, len=16 )
This produces 2 packets: a syn from a to b and a syn-ack from b to a. The latter also has 16 bytes of payload. The packets are both eth:ip4:tcp and contain default values for anything not explicitly specified, such as addresses. The source port is 12345 and the destination port is 80.