Packémon

Packet monster, or Packémon for short! (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ)

TUI tool and Go library for generating packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). This tool is not available for Windows and macOS. I have confirmed that it works on Debian on WSL2.

I intend to develop it patiently🌴

Feature

This TUI tool has two major functions: packet generation and packet monitoring.

This image shows packemon running in Generator / Monitor mode. DNS query packet generated by Generator on the left is shown in 27st line of the Monitor. DNS query response packet is shown as 28nd line, and a more detailed view of it is shown in the image below.

Packemon's Monitor allows user to select each packet by pressing Enter key. Then, select any line and press Enter key to see the details of the desired packet. Pressing Esc key in the packet detail screen will return you to the original packet list screen.

Packet Generator

[!WARNING] While using Generator mode, TCP RST packets automatically sent out by the kernel are dropped. When this mode is stopped, the original state is restored. Incidentally, dropping RST packets is done by running the eBPF program.

• [x] Send generated packets to any network interfaces.

  • You can specify network interface with --interface flag. Default is eth0.

• The following types of packets are covered.

  • [x] Ethernet
  • [x] ARP (WIP)
  • [x] IPv4 (WIP)
  • [x] ICMP (WIP)
  • [x] TCP (WIP)
  • [x] UDP (WIP)
  • [ ] TLSv1.2 (WIP)
    • Currently there is only debug mode
      • TCP 3way handshake ~ TLS handshake ~ TLS Application data
  • [x] DNS (WIP)
  • [x] HTTP (WIP)
  • [ ] xxxxx....

Packet Monitor

• [x] Monitor any network interfaces.

  • You can specify network interface with --interface flag. Default is eth0.

• The following types of packets are covered.

  • [x] Ethernet
  • [x] ARP
  • [x] IPv4 (WIP)
  • [x] ICMP (WIP)
  • [x] TCP (WIP)
  • [x] UDP
  • [ ] DNS (WIP)
    • [x] DNS query
    • [x] DNS query response
    • [ ] xxxxx....
  • [ ] HTTP (WIP)
    • [x] HTTP GET request
    • [x] HTTP GET response
    • [ ] xxxxx....
  • [ ] xxxxx....

Installation

Go
$ go install github.com/ddddddO/packemon/cmd/packemon@latest

deb
$ export PACKEMON_VERSION=X.X.X
$ curl -o packemon.deb -L https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.deb
$ dpkg -i packemon.deb

rpm
$ export PACKEMON_VERSION=X.X.X
$ yum install https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.rpm

apk
$ export PACKEMON_VERSION=X.X.X
$ curl -o packemon.apk -L https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.apk
$ apk add --allow-untrusted packemon.apk

Usage

• Packet Generator

  sudo packemon --send
  

• Packet Monitor

  sudo packemon
  

Another feature

The local node's browser can monitor packets from remote nodes or send arbitrary packets from remote nodes.

                                         +-------------------------------------+
+----------------------+                 | REMOTE NODE                         |
| LOCAL NODE (Browser) |                 | $ sudo packemon-api --interface xxx |
|  Monitor   <---------|-- WebSocket   --|--> HTTP GET  /ws  <-----+           |
|  Generator  ---------|-- POST packet --|--> HTTP POST /packet    |           |
+----------------------+                 |      -> parse packet    |           |                  +---------------+
                                         |           -> Network Interface -----|-- Send packet -->| TARGET NODE x |
                                         +-------------------------------------+                  |               |
                                                                                                  +---------------+

• Remote node

• Local node

[!WARNING] Please note that the following is dangerous.

The following procedure is an example of how you can expose packemon-api to the outside world and monitor and send remote node packets on your browser.

1. (REMOTE) Please install packemon-api and run.

   $ go install github.com/ddddddO/packemon/cmd/packemon-api@latest
   $ sudo packemon-api --interface wlan0
   

2. (REMOTE) Run ngrok and note the URL to be paid out.

   $ ngrok http 8082
   

3. (LOCAL) Enter the dispensed URL into your browser and you will be able to monitor and send packets to remote node.

Related tools

• netcat
• Nmap
• Scapy
• google/gopacket

Acknowledgment

• rivo/tview

  • Packemon is using this TUI library.

• Golangで作るソフトウェアルータ

  • The way Go handles syscalls, packet checksum logic, etc. was helpful. This is a book in Japanese.

Log (japanese)

pi@raspberrypi:~ $ sudo go run main.go

$ sudo tcpdump -U -i eth0 -w - | /mnt/c/Program\ Files/Wireshark/Wireshark.exe -k -i -

$ arping -c 1 1.2.3.4
ARPING 1.2.3.4 from 172.23.242.78 eth0
Sent 1 probes (1 broadcast(s))
Received 0 response(s)

$ nslookup -vc github.com

$ ip -6 route
$ ping -c 1 fe80::1

$ sudo go run cmd/packemon/main.go --send --debug --proto tcp-3way-http