Packémon

Packet monster, or Packémon for short! (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ)

https://github.com/user-attachments/assets/08f96575-7aca-47e7-bdeb-6705ce2bbaba

TUI tool for generating packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). The list of interfaces to be specified is output when packemon interfaces is run.

This tool works on Windows, macOS, and Linux.

This TUI tool is now available on macOS because of cluster2600 support. Thanks🎉!

I intend to develop it patiently🌴

The images of Packemon on REDME should be used as reference only, as they may look different from the actual Packemon.

[!WARNING] This tool is implemented with protocol stacks from scratch and utilizes raw socket.

There may be many bugs. If you find a bug, I would be glad if you raise an issue or give me a pull request!

Feature - Overview

This TUI tool has two major functions: packet generation and packet monitoring.

|Generated DNS query

and Recieved response	Displayed DNS response detail	Filtered packets

This image shows packemon running in Generator / Monitor mode.

DNS query packet generated by Generator on the left is shown in 56 line of the Monitor. DNS query response packet is shown as 57 line, and a more detailed view of it is shown in the middle image.

See here for detailed instructions.

Packemon's Monitor allows user to select each packet by pressing Enter key. Then, select any line and press Enter key to see the details of the desired packet. Pressing Esc key in the packet detail screen will return you to the original packet list screen. The rightmost image shows how the packet list is filtered.

Feature - Generator

Send generated packets to any network interfaces.

• You can specify network interface with --interface flag. Default is eth0.

Packets of various protocols are supported.

details

• [x] Ethernet
• [x] IEEE802.1Q(VLAN tag)
• [x] ARP
• [x] IPv4
• [x] IPv6
• [x] ICMPv4
• [ ] ICMPv6
• [x] TCP
• [x] UDP
• [x] TLSv1.2

• Implementation using Go standard package (The following are valid fields;)

  • IPv4: Source IP Addr, Destination IP Addr
  • IPv6: Source IP Addr, Destination IP Addr
  • TCP: Source Port, Destination Port, Do TCP 3way handshake ?(Check required)
  • HTTP: All fields

• Experimental implementation (full scratch)

  • This tool is not very useful because the number of cipher suites it supports is still small, but an environment where you can try it out can be found here.
  • TCP 3way handshake ~ TLS handshake ~ TLS Application data (encrypted HTTP)
  • Supported cipher suites include
  • TLS_RSA_WITH_AES_128_GCM_SHA256
  • You can check the server for available cipher suites with the following command
  • nmap --script ssl-enum-ciphers -p 443 <server ip>
• [x] TLSv1.3

• Implementation using Go standard package (The following are valid fields;)

  • IPv4: Source IP Addr, Destination IP Addr
  • IPv6: (Not available... Coming soon!)
  • TCP: Source Port, Destination Port, Do TCP 3way handshake ?(Check required)
  • HTTP: All fields

• Experimental implementation (full scratch)

  • This tool is not very useful because the number of cipher suites it supports is still small, but an environment where you can try it out can be found here.
  • TCP 3way handshake ~ TLS handshake ~ TLS Application data (encrypted HTTP)
  • Supported cipher suites include
  • TLS_CHACHA20_POLY1305_SHA256
• [x] QUIC (Using github.com/quic-go/quic-go. The following are valid fields;)
• IPv4: Source IP Addr, Destination IP Addr
• IPv6: Source IP Addr, Destination IP Addr
• UDP: Source Port, Destination Port (UDP selection required)
• QUIC: All fields

• HTTP: All fields

  • 🥳< HTTP/3!

• [x] DNS (WIP)

• [x] HTTP (WIP)
• [ ] xxxxx....
• [ ] Routing Protocols
• IGP (Interior Gateway Protocol)
  • [ ] OSPF (Open Shortest Path First)
  • [ ] EIGRP (Enhanced Interior Gateway Routing Protocol)
  • [ ] RIP (Routing Information Protocol)
• EGP (Exterior Gateway Protocol)
  • [ ] BGP (Border Gateway Protocol)
  • Currently there is only debug mode
    • TCP 3way handshake ~ Open ~ Keepalive ~ Update ~ Notification

[!WARNING] While using Generator mode, TCP RST packets automatically sent out by the kernel are dropped. When this mode is stopped, the original state is restored. Probably😅. Incidentally, dropping RST packets is done by running the eBPF program. The background note incorporating the eBPF is the POST of X around here.

[!TIP] While in Generator mode, output of bpf_printk of eBPF program can be checked by executing the following command.

$ sudo mount -t debugfs none /sys/kernel/debug (only once)

$ sudo cat /sys/kernel/debug/tracing/trace_pipe

Feature - Monitor

Monitor any network interfaces.

• You can specify network interface with --interface flag. Default is eth0.

Can view details for L5 and higher.

• You can view details at the L5 level or higher by specifying the --parse-full flag.
• However, there are currently few supported protocols, and development progress has been slow...
• If you do not specify this flag, the parse results up to L4 will be displayed (though a full dump will still be shown).

Can filter packets to be displayed.

• You can filter the values for each item (e.g. Dst, Proto, SrcIP...etc.) displayed in the listed packets.

Specified packets can be saved to pcapng file.

Packets of various protocols are supported.

details

• [x] Ethernet
• [x] IEEE802.1Q(VLAN tag)
• [x] ARP
• [x] IPv4 (WIP)
• [x] IPv6 (WIP)
• [x] ICMPv4 (WIP)
• [ ] ICMPv6
• [x] TCP (WIP)
• [x] UDP
• [x] TLSv1.2 (WIP)
• [ ] TLSv1.3
• [ ] DNS (WIP)
• [x] DNS query
• [x] DNS query response
• [ ] xxxxx....
• [ ] HTTP (WIP)
• [x] HTTP GET request
• [x] HTTP GET response
• [ ] xxxxx....
• [ ] xxxxx....
• [ ] Routing Protocols
• IGP (Interior Gateway Protocol)
  • [ ] OSPF (Open Shortest Path First)
  • [ ] EIGRP (Enhanced Interior Gateway Routing Protocol)
  • [ ] RIP (Routing Information Protocol)
• EGP (Exterior Gateway Protocol)
  • [ ] BGP (Border Gateway Protocol)

[!WARNING] If packet parsing fails, it is indicated by “Proto:ETHER” as shown in the following image.

If you want to check the details of the packet, you can select the line, save it to a pcapng file, and import it into Wireshark or other software🙏

Installation

Source build

[!IMPORTANT] For Linux, require 'Dependencies' section of https://ebpf-go.dev/guides/getting-started/#ebpf-c-program

For Windows, require Npcap. Check the following

• Support raw 802.11 traffic (and monitor mode) for wireless adapters
• Install Npcap in WinPcap API-compatible Mode

$ git clone git@github.com:ddddddO/packemon.git
$ cd packemon
(For Linux)
$ cd tc_program/ && go generate && cd -
(For Linux or macOS)
$ go build -o packemon cmd/packemon/*.go
$ ls | grep packemon
$ mv packemon /usr/local/bin/
(For Windows)
$ go build -o packemon.exe .\cmd\packemon\

Package manager

[!IMPORTANT] It might be that the generation of the executable file is failing. At that time, install it in another way!

For arm64, convert “amd64” to “arm64” in the following commands and execute them.

deb
$ export PACKEMON_VERSION=X.X.X
$ curl -o packemon.deb -L https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.deb
$ dpkg -i packemon.deb

rpm
$ export PACKEMON_VERSION=X.X.X
$ (Ubuntu) yum install https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.rpm
or
$ (Fedora) dnf install https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.rpm

apk
$ export PACKEMON_VERSION=X.X.X
$ curl -o packemon.apk -L https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.apk
$ apk add --allow-untrusted packemon.apk

Homebrew
$ brew install ddddddO/tap/packemon

AUR
https://aur.archlinux.org/packages?K=packemon

Confirmed executable in the following environments

• OS: Debian GNU/Linux 12 (bookworm) on WSL2
• Kernel: 5.15.167.4-microsoft-standard-WSL2
• Architecture: x86_64
• OS: Ubuntu 22.04.3 LTS on WSL2
• Kernel: 5.15.167.4-microsoft-standard-WSL2
• Architecture: x86_64
• OS: Fedora Linux 42 on WSL2
• Kernel: 5.15.167.4-microsoft-standard-WSL2
• Architecture: x86_64
• OS: Debian GNU/Linux 12 (bookworm) on Google Pixel 7a
• Kernel: 6.1.0-34-arm64
• Architecture: aarch64
• OS: macOS
• OS: Windows 11 Pro
• Confirm MAC address of default gateway (via PowerShell) console PS > $defaultGateway = (Get-NetRoute -DestinationPrefix "0.0.0.0/0" | Sort-Object -Property InterfaceMetric | Select-Object -First 1).NextHop PS > echo $defaultGateway 192.168.10.1 PS > Get-NetNeighbor -IPAddress $defaultGateway | Select-Object -ExpandProperty LinkLayerAddress

cmd

• OS: cat /etc/os-release
• Kernel: uname -r
• Architecture: uname -m

Go install

For macOS, besides Homebrew, this is also easy.

[!IMPORTANT] For Windows, require Npcap. Check the following

• Support raw 802.11 traffic (and monitor mode) for wireless adapters
• Install Npcap in WinPcap API-compatible Mode

$ go install github.com/ddddddO/packemon/cmd/packemon@latest

Usage - Overview

```console $ packemon --help NAME: packemon - Packet monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux

          ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ
                                ○
                               о
                              ｡

                             ,､-､_  ＿_
           　　　　,､-―､_,､'´　　　￣　　`ヽ,
           　　　/　　　　　　 ・　　　 ．　　　ｌ、
           　　　ｌ,　　　　　　 ヾニニつ　　　　`ヽ、
           　　　 |　　　　　　　　　　　　　　　　　 `ヽ,
           　　　 ﾉ　　　　　　　　　　　　　　　　　　ノ
           　　 /::::　　　　　　　　　　　　　　　　　/
           　／:::::::　　　　　　　　　　　　　　　　..::l、
           /::::::::::::::::::......:::::::.　　　　　　　............::::::::::`l,
           l::::::::::::::::::::::::::::::::::::......　　　....:::::::::::::::::::::::::::::`l,
           ヽ,:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::ﾉ
           　　￣￣``ヽ､_:::::::::::::::::::::::,､-―´￣`ヽ､,､-'
           　　　　　　　　 `ヽ―-―'´

USAGE: packemon [global options] [command [command options]]

VERSION: 1.X.Y / revision zzzzzzz

COMMANDS: monitor, m, mon Monitor mode. You can monitor packets received and sent on the specified interface. Default is 'eth0' interface. generator, g, gen Generator mode. Arbitrary packets can be generated and sent. interfaces, i, intfs Check the list of interfaces. debugging, d, debug Debugging mode. version, v Prints the version. help, h Shows a list of