You are on page 1of 3

Packetyzer

https://github.com/AnwarMohamed/Packetyzer Anwar Mohamed < anwarelmakrahy@gmail.com >

Abstract
Packetyzer is a high level library for C++ designed to make easier the forging and decoding of network packets. It has the ability to decode packets of most common network protocols, capture them and send them on the wire. This capability allows construction of tools that can probe, scan or attack networks. It enables the creation of networking tools in a few lines. A packet is described by its protocol layer type where fields of each layer have useful default values that you can overload. It has the ability to analyze pcap files or captured packets using Wireshark. Packetyzer has the ability to capture packets, analyze them and send them over the wire. It analyzes the packets and the connection streams ... from the Ethernet header to the Application layer protocols. Packetyzer is in the form of Dynamic Link Library (DLL) that will help to be included in many tools and projects.

Previous work
Scapy : Scapy is a packet manipulation tool for computer networks, written in Python
by Philippe Biondi. It can forge or decode packets, send them on the wire, capture them, and match requests and replies. It can also handle tasks like scanning, tracerouting, probing, unit tests, attacks, and network discovery. Scapy provides a Python interface into libpcap, (Winpcap on Windows), in a similar way to that in which Wireshark provides a view and capture GUI. It can interface with a number of other programs to provide visualization including Wireshark for decoding packets, GnuPlot for providing graphs, graphviz or VPython for visualization, etc.

What is new ?
Raw packets are represented as array of cPacket class where each packet is analyzed carefully. cPacket is the main packet representation used in Packetyzer.
Packets are feed to packet stack by cPcapFile using a pcap file , cPacketGen generating raw packets or cWinpcapCapture capturing network packets, where this stack is analyzed and is represented as a Traffic structure by cTraffic class. cTraffic is responsible to analyze packets of the same session and add the related packets by their protocol types as Streams which are composed of IP protocols cConStream and non-IP protocols cARPStream & ICMPStream. cConstream analyze TCP and UDP protocols then the application layer protocols are decoded into their related Streams like cHTTPStream. 1

Namespaces
namespace Elements: namespace Generators: namespace Analyzers: namespace Traffic: namespace Connections class cTraffic namespace Streams class cUDPStream class cDNSStream class cICMPStream namespace Capture: namespace Send: class cFile class cPacketGen class cPacket class cString class cPcapFile class cHash

class cConnection

class cTCPReassembler

class cConStream class cTCPStream

class cARPStream class cHTTPStream

class cWinpcapCapture class cWinpcapSend

Features
It has the ability to decode: SLL, Ethernet, ARP, IP, IP options, IGMP, ICMP, TCP, TCP options, UDP, DNS and HTTP. The cPacket class is an abstract class designed to manage the data structure of any packet, which is the base of all protocols implemented in Packetyzer. All the classes derived from the cPacket class have a set of common methods as following: Each packet is decoded according its own protocol type. Packet checksum and TTL are checked to detect if the packet I forged. Every packet is split into different headers according to its layered protocols starting to Ethernet protocol until the application layer protocol. Packetyzer it has the ability to recalculate the checksum and correct it in the actual packet. UDP & TCP data sizes are calculated and their data are parsed out into Character pointers to be used later, Also TCP and IP options are parsed out. Connection streams separation where packets of the same session are extracted and stored into stream class arrays. Supported streams are: IP Streams, ARP Streams, ICMP Streams, TCP Streams and UDP Streams as protocols and it also analyze DNS Streams and HTTP Streams as application layer protocols. The ability to reassemble TCP Segments and get data buffer from the packets reassembly. It can be used to extract files from capture files sent or received through HTTP protocol for example. Packetyzer can capture packets using Winpcap library and sort each group according to its type in a cTraffic structure. Sending raw packets on the wire that have been captured or generated by cPacketGen. A Packet Generator that can generate different types of packets. It has powerful options to manipulate and craft specific packets.

To-Do List
Enhancing TCP Reassembler to be more intelligent. Implementing IPv6, IPv6 Options Decoders. Adding Layered Service Provider class. Adding more application layer parsers. Inspecting and optimizing memory usage. 3

You might also like