abcip is a simple packet crafting tool. It is intended to be easy to generate pcaps for testing, especially pcaps containing flawed packets.
To get started after cloning the repo, do this:
./bootstrap ./configure make make install You can also ./configure --enable-daq to produce a DAQ that can be used with Snort. Use --with-daq-includes=/path/to/daq/include if needed.
To run it, do this:
abcip [options] < abc-file
Options are:
--help or -? to get this help --help-a or -?a to get a list of a|b protocol options --help-b or -?b to get a list of a|b protocol options --help-c or -?c to get a list of c statement options --help-d or -?d to get a list of d statement options --help-bind to get a list of available protocol bindings --help-config same as --help-c --help-data to dump the default stream data --help-define same as --help-d --help-packet same as --help-a and --help-b --help-protos to get a list of supported protocols --help-users to get a list of supported users --license outputs license information --pcap <file> writes each packet to the given pcap file --raw changes input to just payload data (no commands) --snap <len=65535> set pcap snaplen --stack <protos=eth:ip4:tcp> sets default encapsulations --trace outputs a text summary of each packet --user <type=user> sets default user type --full-monty to use original scene V default stream data --full-dubya to use obfuscated scene V default stream data --version outputs version information abcip returns 0 for success or -1 for error reading abc file. See the README for more information on the abc file.
Here is a an example abc file:
# define the stack d ( stack="eth:ip4:tcp" ) # configure tcp ports c ( 4:a=12345, b=80 ) # generate a packet from a to b a ( syn ) # generate a packet from a to b b ( syn, ack, len=16 ) This produces 2 packets: a syn from a to b and a syn-ack from b to a. The latter also has 16 bytes of payload. The packets are both eth:ip4:tcp and contain default values for anything not explicitly specified, such as addresses. The source port is 12345 and the destination port is 80.