packit(8)

📦 version 1.8.1, in debian bookworm, debian trixie, opensuse-leap 16.0, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

🎀 NAME 🎀

Packit — network packet generator and capture tool. It's packit(8) bestie, and she's here to make packets do whatever you want 💅

✨ SYNOPSIS ✨

Okay so first things first, there's two whole vibes you can run this in. Here's the tea 🍵

Packet capture:

packit -m capture [-cGHnvsX] [-i interface] [-r|-w file] expression

Packet injection:

packit -m inject [-t protocol] [-aAbcCdDeFgGhHIjJkKlLmMnNoOpPqQrRsSTuUvwWxXyYzZ] [-i interface]

🦋 DESCRIPTION 🦋

So Packit is a network auditing tool, and honestly? Her whole value comes from being able to customize, inject, monitor, and manipulate IP traffic. She lets you define (spoof 💀) all the TCP, UDP, ICMP, IP, ARP, RARP and Ethernet header options, which means she's genuinely useful for testing firewalls, intrusion detection systems, port scanning, simulating network traffic, and general TCP/IP auditing. She's also, no cap, an excellent tool for actually learning TCP/IP. Like she's the main character of your networking education fr fr ✨

💖 PACKIT BASE OPTIONS 💖

  • -m mode — pick your runtime mode, bestie. The supported modes rn are capture, inject and trace. And heads up, the default mode is inject. Slay.

🌸 PACKET CAPTURE OPTIONS 🌸

The packet capture options are giving:

  • -c count — tells her how many packets to capture. You pick the number, she does the rest 💅
  • -e — shows you the link-layer header data. Look at the lil details ✨
  • -G — displays the timestamp in GMT instead of localtime. GMT girlies rise 🫶
  • -i interface — listen on interface. And if you don't say which one? She'll just use the lowest numbered device in the 'up' state (excluding loopback). She's self-sufficient like that.
  • -n — do not resolve host addresses to names, but DO resolve port numbers. Basically this disables DNS lookups.
  • -nn — do not resolve port numbers to their protocol names, but DO resolve host addresses. Balance ✨
  • -nnn — do not resolve host addresses or port numbers. Nothing gets resolved, we're going full mystery mode 💀
  • -r file — read packet data from a tcpdump formatted binary log file. Example: a file created with the -w option. Recycled content, we love her.
  • -s snaplen — read snaplen bytes of data from each packet rather than the default of 68. Bigger bites, more tea.
  • -v — enables verbose packet capture. She gets chatty, and honestly? We're here for it.
  • -w file — write the raw packets to file rather than displaying time to stderr.
  • -X — displays a hexadecimal & ascii dump of each packet, up to snap length bytes. Hex girlies, this one's for you 🔥
  • expression — this is what selects which packets should be displayed. And if you give her no expression at all? Every packet gets displayed, easy. This option is based in the pcap library, so go read the pcap-filter(7) manpage if you want the more detailed info. iykyk 📖

🔥 PACKET INJECTION AND TRACE 🔥

So packet injection is what you use to define and inject network traffic onto your network. You can define essentially any ARP, IP, TCP, UDP, ICMP and Ethernet header value you want. That's valuable in a bunch of ways, including testing firewalls, testing intrusion detection systems, simulating traffic flow, and general TCP/IP auditing. Queen behavior honestly 👑

👑 CHOOSE A PROTOCOL 👑

  • -t protocol — tells her what type of packet to inject. The supported values are: ARP, RARP, TCP, UDP and ICMP. She defaults to TCP in inject mode and to ICMP in trace mode. Pick your fighter 💖

💅 PACKET INJECTION AND TRACE GENERAL 💅

This section is all about the operational command-line options, so let's get into it:

  • -c count — count is the total number of packets you wanna inject. And plot twist: a count value of 0 means forever. She'll never stop, she's committed 💀
  • -b burst rate — specifies how many packets to inject every interval (and that interval is defined by -w, keep up bestie). A burst rate of 0 will send packets as quickly as possible. No chill whatsoever 🔥
  • -h — host response mode! Enabling this makes her print any packet you inject and then wait to see if the remote host responds. For the timeout, see the -H option. She's waiting for a text back fr 🥺
  • -H timeout — specifies the timeout value (in seconds) to use with -h. This defaults to 1 second. Don't leave her hanging too long.
  • -i interface — specify the interface to transmit from, in case your machine has multiple interfaces. Choices, choices ✨
  • -I tci — specify 802.1Q TCI (that's the VLAN ID/CFI/priority combination). Heads up though: this feature is EXPERIMENTAL. Be careful, bestie 🙈
  • -v — verbose injection mode. Displays each packet you inject. It also has the same effect as it does in capture mode while used with the -h option. Double duty, iconic.
  • -p payload — this one defines the payload portion of the header. A Hex payload should be prefixed with 0x, with each value separated by a whitespace. Here's an ASCII example: -p 'hello, this is my packet'. And here's a Hex example: -p '0x 70 61 63 6B 69 74'. Pick your flavor 🍓
  • -w interval — specify the number of seconds to wait between packet bursts. This defaults to 1 second. Patience is a virtue 💜
  • -Z length — specify the size of the packet(s) to inject. The maximum value is 65535. That's the ceiling, don't try her.

🌈 IP HEADER OPTIONS 🌈

This section is all the IP header command-line options, let's go:

  • -s src address — the IP address the packet will appear to come from (spoofing era 😌). If you don't specify one, she'll default to the IP address of the lowest numbered device in the 'up' state, excluding loopback. She handles it.
  • -sR — use a random source IP address. Chaos, but make it cute ✨
  • -d dst address — the IP address of the machine you'd like to contact. Who are we texting today?
  • -dR — use a random destination IP address. Surprise destination, no cap 🎲
  • -o type of service — TOS values are typically in hexadecimal format, however, packit only accepts TOS values as integers. Below are the 4 valid TOS bit values:
    • Minimize delay: 16 (0x10)
    • Maximize throughput: 8 (0x08)
    • Maximize reliability: 4 (0x04)
    • Minimize monetary cost: 2 (0x02)
  • -n ID number — the ID number is used to identify each datagram sent by a host. It generally increments by one with each datagram sent. This value is random by default. Lil increments, so satisfying.
  • -T TTL — the TTL value defines the upper limit on the number of devices through which the datagram may pass to reach its destination. The default value is 128. She knows when to stop (unlike some people 💀).
  • -V IP protocol number — specify the IP protocol associated with this packet (RAWIP only). The default value is 255. Raw and unfiltered, love that for her.

⭐ TCP HEADER OPTIONS ⭐

This section covers the TCP header command-line options:

  • -S src port — the port from which our source address is communicating from. This value is random by default. Mystery port, mysterious vibes 🦋
  • -D dst port — the port on the destination we'd like to communicate on. In inject mode this value is 0 by default, while in trace mode this value is random by default. You can also specify a range of addresses in the format: -D 1:1024. Range queen 👑
  • -f — do not fragment this packet. Leave it whole, she's perfect as is 💅
  • -F tcp flags — there are 6 TCP header flag bits, and they can be used in combination with one another. You specify them using these identifiers:
    • S : SYN (Synchronization sequence number)
    • F : FIN (Sender is finished)
    • A : ACK (Acknowledgement number is valid)
    • P : PSH (Receiver should push this data to the remote host)
    • U : URG (The urgent pointer is valid)
    • R : RST (Reset this connection)

As an example, to set the SYN and FIN bits, use the following: -F SF. Combo moves, we love to see it 🔥

  • -q sequence number — the sequence number is a 32-bit unsigned (positive) number used to identify the byte in a stream of data from the sending TCP to the receiving TCP that the first byte of data represents. Math girlies, this one's for you 🧚
  • -a ack number — the acknowledgement (ack) number defines the next sequence number that the sender of the ack expects to see. It's typically the sequence number + 1 during valid TCP communication. It's a 32-bit unsigned (positive) number. Consent and confirmation, we love a healthy relationship 💖
  • -W window size — the window size provides flow control. It's a 16-bit number that defines how many bytes the receiver is willing to accept. The default value is 1500. She knows her limits ✨
  • -u urgent pointer — in valid TCP communication, the urgent pointer is only useful if the URG flag is set. Used with the sequence number, it points to the last byte of urgent data. Urgent! But only when URG said so 🚨

🍓 UDP HEADER OPTIONS 🍓

This section documents the UDP header command-line options. Oh and btw, UDP is the default IP protocol for TRACE mode. Noted 📝

  • -S src port — the port from which our source address is communicating from. This value is random by default. Same energy as her TCP twin 💜
  • -D dst port — the port on the destination we'd like to communicate on. In inject mode this value is 0 by default, while in trace mode this value is random by default. You can also specify a range of addresses in the format: -D 1:1024. Ranges stay undefeated 🎀

💖 ICMP HEADER OPTIONS 💖

okay so this section is literally all about the ICMP header command-line options, bestie. no cap.

  • -K type — specify the ICMP type. see docs/ICMP.txt for details on types. on Debian systems this file can be found at /usr/share/doc/packit/ICMP.txt. 💅
  • -C code — specify the ICMP code. see docs/ICMP.txt for details on codes. on Debian systems this file can be found at /usr/share/doc/packit/ICMP.txt. ✨

🌸 ICMP ECHO REQUEST AND ECHO REPLY OPTIONS 🌸

  • -N id number — define the 16-bit ICMP identification number. this value is random by default. 🎀
  • -Q sequence number — define the 16-bit ICMP sequence number. this value is random by default. 🎀

🌈 ICMP UNREACHABLE OR REDIRECT OR TIME EXCEEDED OPTIONS 🌈

  • -g gateway — define the gateway in which to redirect traffic to. this option is only used for ICMP redirects (type 5). 🫶
  • -j address — define the source address of the original packet.
  • -J src port — define the source port of the original packet.
  • -l address — define the destination address of the original packet.
  • -L dst port — define the destination port of the original packet.
  • -m time to live — define the Time To Live of the original packet. this option defaults to 128. ⏳
  • -M id — define the IP ID of the original packet. this option defaults to random.
  • -O type of service — define the Type of Service of the original packet. see the -o option for the possible values.
  • -P protocol — define the protocol of the original packet. this option defaults to UDP. 🌐

🎀 MASK REQUEST AND MASK REPLY OPTIONS 🎀

  • -N id number — define the 16-bit ICMP identification number. this value is random by default. 💖
  • -Q sequence number — define the 16-bit ICMP sequence number. this value is random by default. 💖
  • -G address mask — define the address network mask. the default value for this option is 255.255.255.0. 🦋

⏰ TIMESTAMP REQUEST AND TIMESTAMP REPLY OPTIONS ⏰

  • -N id number — define the 16-bit ICMP identification number. this value is random by default. ✨
  • -Q sequence number — define the 16-bit ICMP sequence number. this value is random by default. ✨
  • -U original timestamp — define the 32-bit original timestamp. this value is 0 by default.
  • -k received timestamp — define the 32-bit received timestamp. this value is 0 by default.
  • -z transmit timestamp — define the 32-bit transmit timestamp. this value is 0 by default.

👑 ARP AND RARP HEADER OPTIONS 👑

this section documents the ARP/RARP header command-line options. these options have the ability to do the most damage with the least effort, especially on large cable and DSL networks. use with caution. 💀

these options are giving chaos energy fr fr. be careful out there, bestie.

packit only supports ARP/RARP protocol addresses in IPv4 format. 🫶

  • -A operation type — define the ARP / RARP / IRARP operation type. the valid options are as follows:
    • 1 : ARP Request (Default for ARP packages)
    • 2 : ARP Reply
    • 3 : Reverse ARP Request (Default for RARP packages)
    • 4 : Reverse ARP Reply
    • 5 : Inverse ARP Request
    • 6 : Inverse ARP Reply
  • -y target IP address — the IP address of the target host.
  • -yR — use a random target host IP address.
  • -Y target ethernet address — the Ethernet (hardware) address of the target host.
  • -YR — use a random target host Ethernet address.
  • -x sender IP address — the IP address of the sender host.
  • -xR — use a random sender host IP address.
  • -X sender ethernet address — the Ethernet (hardware) address of the sender host.
  • -XR — use a random sender host Ethernet address.

🦋 ETHERNET HEADER OPTIONS 🦋

this section documents the Ethernet header command-line options. iconic.

  • -e src ethernet address — the Ethernet (hardware) address the packet will appear to come from. if not defined, the original Ethernet address will be used. 💅
  • -eR — use a random source Ethernet address. if you define this, you will most likely need to define the destination Ethernet header value as well. when using either -e or -E, you enable link level packet injection and the destination cannot be auto-defined while injecting in this manner. 🔥
  • -E dst ethernet address — the Ethernet (hardware) of the next routeable interface which the packet will cross while making its way to the destination.
  • -ER — use a random destination Ethernet address. the following two rules should be followed if you actually want the destination to receive the packets you're sending:
    1. if the destination exists beyond your default route (gateway), the destination Ethernet address should be set to the default routes Ethernet address. this can typically be found by using the arp(8) command.
    2. if the destination exists on your subnet, the destination Ethernet address should be set to its Ethernet address. this can typically be found by using the arp(8) command.

🔥 PACKET CAPTURE EXAMPLES 🔥

print all TCP communications that doesn't revolve around SSH (port 22):

# packit -m cap 'tcp and not port 22'

print the start and end packets (the SYN and FIN packets) of each TCP conversation that involves a non-local host, don't resolve addresses and display hex/ascii dump of the packet:

# packit -m cap -nX 'tcp[tcpflags] & (tcp-syn|tcp-fin) != 0 and not src and dst net localnet'

write the first 10 ICMP packets captured to a file:

# packit -m cap -c 10 -w /tmp/mylog 'icmp'

💥 PACKET INJECTION EXAMPLES 💥

inject 10 ICMP type 8 (echo request) packets from host 3.1.33.7 to host 192.168.0.1 and watch for a response:

# packit -t icmp -s 3.1.33.7 -d 192.168.0.1 -c 10 -h

inject an ICMP type 18 (mask reply) packet with an ICMP id of 211 and an address mask of 255.255.255.0:

# packit -t icmp -K 18 -d 127.0.0.1 -N 211 -G 255.255.255.0

inject 5 TCP packets from random hosts to www.example.com with the SYN flag set, a window size of 666, a random source Ethernet address, a destination Ethernet address of 00:53:00:0f:00:0d, with a payload of "HI JOHN", displaying each packet injected.

# packit -sR -d www.example.com -F S -c 5 -W 666 -eR -E 00:53:00:0f:00:0d -p 'HI JOHN' -v

or simplifying the MAC address:

# packit -sR -d www.example.com -F S -c 5 -W 666 -eR -E 0:53:0:f:00:d -p 'HI JOHN' -v

inject a total of 1000 TCP packets in 20 packet per second bursts from 192.168.0.1 on port 403 to 192.168.0.20 on port 80 with the SYN and RST flags set, a sequence number of 12345678910 and a source Ethernet address of 0:0:0:0:0:0:

# packit -s 192.168.0.1 -d 192.168.0.20 -S 403 -D 80 -F SR -q 12345678910 -c 1000 -b 20 -e 0:0:0:0:0:0

inject a TCP packets from 10.22.41.6 to 172.16.1.3 on ports ranging from 1-1024 with the SYN flag set and display each packet we send:

# packit -s 10.22.41.6 -d 172.16.1.3 -D 1-1024 -F S -v

inject a broadcast ARP reply stating that 4.3.2.1 is at 00:53:00:01:02:03. also, spoof the source Ethernet address for a little more authenticity and supply the payload in hex:

# packit -t arp -A 2 -x 4.3.2.1 -X 5:4:3:2:1:0 -e 00:53:00:01:02:03 -p '0x 70 61 63 6B 69 74'

🌟 TRACE ROUTE EXAMPLES 🌟

appear as a DNS response by using a UDP source port of 53 (DNS):

# packit -m trace -t UDP -d 192.168.2.35 -S 53

appear as HTTP traffic by using TCP port 80:

# packit -m trace -t TCP -d www.google.com -S 80 -FS

💀 BUGS 💀

👀 SEE ALSO 👀

arp(8), pcap(3), pcap-filter(7), tcpdump(1)

✨ AUTHOR ✨

the original author of packit is Darren Bounds. currently, this project is maintained by volunteers. 🫶

the latest version of Packit can be found at https://github.com/resurrecting-open-source-projects/packit

this page is from packit-1.8, dated 04 Nov 2021, and it's the packit(8) manpage. stay iconic, bestie. 💅✨

📦 where this page comes from