Skip to content

Instantly share code, notes, and snippets.

@dantmnf
Created December 20, 2014 12:12
Show Gist options
  • Save dantmnf/c61ee91836681826ad93 to your computer and use it in GitHub Desktop.
Save dantmnf/c61ee91836681826ad93 to your computer and use it in GitHub Desktop.
script to duplicate outgoing TCP packets
#!/usr/bin/env ruby
require 'socket'
require 'pcaprub'
require 'packetfu'
IDENTIFY_TTL = 105
interface = 'eth0'
DUPS = 1 # number of duplicated packet(s)
SIOCGIFINDEX = 0x8933
rsock = Socket.new(Socket::AF_PACKET, Socket::SOCK_RAW, Socket::IPPROTO_RAW)
ifreq = [interface.dup].pack('a32')
rsock.ioctl(SIOCGIFINDEX, ifreq)
rsock.bind([Socket::AF_PACKET].pack('s') + [Socket::IPPROTO_RAW].pack('n') + ifreq[16..20]+ ("\x00" * 12)) #let's blame ruby
localaddrs = Socket.ip_address_list.select{|intf| intf.ipv4? or intf.ipv4_private? and !intf.ipv4_loopback? and !intf.ipv4_multicast? }
capture = PCAPRUB::Pcap.open_live(interface, 65535, true, 0)
filter = localaddrs.map{|addr| "src host #{addr.ip_address}" }.join(' or ') + ' and tcp'
capture.setfilter(filter)
begin
capture.each do |pkt|
pktf = PacketFu::IPPacket.parse pkt
if pktf.ip_ttl != IDENTIFY_TTL
pktf.ip_ttl = IDENTIFY_TTL
begin
DUPS.times { rsock.sendmsg_nonblock pktf.to_s }
rescue => e
p e
end
end
end
ensure
capture.close
rsock.close
end
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment