Packet monster, or Packémon for short! (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ)

TUI tool for generating packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). The list of interfaces to be specified is output when packemon --interfaces is run.
This tool works on Windows, macOS, and Linux.

This TUI tool is now available on macOS because of cluster2600 support. Thanks🎉!

I intend to develop it patiently🌴

The images of Packemon on REDME should be used as reference only, as they may look different from the actual Packemon.

This TUI tool has two major functions: packet generation and packet monitoring.

Generated DNS query and Recieved response	Displayed DNS response detail	Filtered packets

This image shows packemon running in Generator / Monitor mode.
DNS query packet generated by Generator on the left is shown in 56 line of the Monitor. DNS query response packet is shown as 57 line, and a more detailed view of it is shown in the middle image.
See here for detailed instructions.

Packemon's Monitor allows user to select each packet by pressing Enter key. Then, select any line and press Enter key to see the details of the desired packet. Pressing Esc key in the packet detail screen will return you to the original packet list screen. The rightmost image shows how the packet list is filtered.

• Send generated packets to any network interfaces.

  • You can specify network interface with --interface flag. Default is eth0.

• Packets of various protocols are supported.

  details

  • Ethernet
  • ARP (WIP)
  • IPv4 (WIP)
  • IPv6 (WIP)
  • ICMPv4 (WIP)
  • ICMPv6
  • TCP (WIP)
  • UDP (WIP)
  • TLSv1.2 (WIP)
    • This tool is not very useful because the number of cipher suites it supports is still small, but an environment where you can try it out can be found here.
      • TCP 3way handshake ~ TLS handshake ~ TLS Application data (encrypted HTTP)
    • Supported cipher suites include
      • TLS_RSA_WITH_AES_128_GCM_SHA256
    • You can check the server for available cipher suites with the following command
      • nmap --script ssl-enum-ciphers -p 443 <server ip>
  • TLSv1.3 (WIP)
    • This tool is not very useful because the number of cipher suites it supports is still small, but an environment where you can try it out can be found here.
      • TCP 3way handshake ~ TLS handshake ~ TLS Application data (encrypted HTTP)
    • Supported cipher suites include
      • TLS_CHACHA20_POLY1305_SHA256
  • DNS (WIP)
  • HTTP (WIP)
  • xxxxx....
  • Routing Protocols
    • IGP (Interior Gateway Protocol)
      • OSPF (Open Shortest Path First)
      • EIGRP (Enhanced Interior Gateway Routing Protocol)
      • RIP (Routing Information Protocol)
    • EGP (Exterior Gateway Protocol)
      • BGP (Border Gateway Protocol)
        • Currently there is only debug mode
          • TCP 3way handshake ~ Open ~ Keepalive ~ Update ~ Notification

• Monitor any network interfaces.

  • You can specify network interface with --interface flag. Default is eth0.

• Can filter packets to be displayed.

  • You can filter the values for each item (e.g. Dst, Proto, SrcIP...etc.) displayed in the listed packets.

• Specified packets can be saved to pcapng file.

• Packets of various protocols are supported.

  details

  • Ethernet
  • ARP
  • IPv4 (WIP)
  • IPv6 (WIP)
  • ICMPv4 (WIP)
  • ICMPv6
  • TCP (WIP)
  • UDP
  • TLSv1.2 (WIP)
  • TLSv1.3
  • DNS (WIP)
    • DNS query
    • DNS query response
    • xxxxx....
  • HTTP (WIP)
    • HTTP GET request
    • HTTP GET response
    • xxxxx....
  • xxxxx....
  • Routing Protocols
    • IGP (Interior Gateway Protocol)
      • OSPF (Open Shortest Path First)
      • EIGRP (Enhanced Interior Gateway Routing Protocol)
      • RIP (Routing Information Protocol)
    • EGP (Exterior Gateway Protocol)
      • BGP (Border Gateway Protocol)

$ git clone git@github.com:ddddddO/packemon.git
$ cd packemon
(For Linux)
$ cd tc_program/ && go generate && cd -
(For Linux or macOS)
$ go build -o packemon cmd/packemon/*.go
$ ls | grep packemon
$ mv packemon /usr/local/bin/
(For Windows)
$ go build -o packemon.exe .\cmd\packemon\

For arm64, convert “amd64” to “arm64” in the following commands and execute them.

deb
$ export PACKEMON_VERSION=X.X.X
$ curl -o packemon.deb -L https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.deb
$ dpkg -i packemon.deb

rpm
$ export PACKEMON_VERSION=X.X.X
$ (Ubuntu) yum install https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.rpm
or
$ (Fedora) dnf install https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.rpm

apk
$ export PACKEMON_VERSION=X.X.X
$ curl -o packemon.apk -L https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.apk
$ apk add --allow-untrusted packemon.apk

Homebrew
$ brew install ddddddO/tap/packemon

• OS: Debian GNU/Linux 12 (bookworm) on WSL2
  • Kernel: 5.15.167.4-microsoft-standard-WSL2
  • Architecture: x86_64
• OS: Ubuntu 22.04.3 LTS on WSL2
  • Kernel: 5.15.167.4-microsoft-standard-WSL2
  • Architecture: x86_64
• OS: Fedora Linux 42 on WSL2
  • Kernel: 5.15.167.4-microsoft-standard-WSL2
  • Architecture: x86_64
• OS: Debian GNU/Linux 12 (bookworm) on Google Pixel 7a
  • Kernel: 6.1.0-34-arm64
  • Architecture: aarch64
• OS: macOS
• OS: Windows 11 Pro
  • Confirm MAC address of default gateway (via PowerShell)

    PS > $defaultGateway = (Get-NetRoute -DestinationPrefix "0.0.0.0/0" | Sort-Object -Property InterfaceMetric | Select-Object -First 1).NextHop
    PS > echo $defaultGateway
    192.168.10.1
    PS > Get-NetNeighbor -IPAddress $defaultGateway | Select-Object -ExpandProperty LinkLayerAddress

For macOS, besides Homebrew, this is also easy.

$ go install github.com/ddddddO/packemon/cmd/packemon@latest

$ sudo setcap cap_net_raw,cap_bpf,cap_sys_admin,cap_net_admin+ep /path/to/packemon
$ packemon --send

or

$ sudo packemon --send

$ sudo setcap cap_net_raw+ep /path/to/packemon
$ packemon

or

$ sudo packemon

1. setup

   # Generator
   $ sudo packemon --send

   # Monitor
   $ sudo packemon

   ← Generator | Monitor →

   

2. Generator

   • Lα > Ethernet > Ether Type > IPv4

   • Lβ > IPv4 > Protocol > UDP

   • Lβ > IPv4 > Destination IP Addr > 1.1.1.1

     • Enter the address of DNS resolver here. Above is the address of Cloudflare resolver.

   • Lγ > UDP > Destination Port > 53

   • Lγ > UDP > Automatically calculate length ? > (Check!)

   • Lε > DNS > Queries Domain > go.dev

     • Enter here the domain for which you want to name resolution.

   • Lε > DNS > Click on Send!

     • At this time, DNS query is sent with the contents set so far.

   

3. Monitor

   • Find records where Proto: DNS and DstIP or SrcIP is 1.1.1.1. Select each record to see the packet structure of the DNS query and the packet structure of the DNS response.

     • List

     • DNS query (DstIP: 1.1.1.1)

     • DNS response (SrcIP: 1.1.1.1)

• Wireshark
• tcpdump
• netcat(nc)
• Nmap
• Scapy
• google/gopacket / gopacket/gopacket (maintained)

• rivo/tview

  • Packemon is using this TUI library.

• Golangで作るソフトウェアルータ

  • The way Go handles syscalls, packet checksum logic, etc. was helpful. Packemon was inspired by this book and began its development. This is a book in Japanese.

• ネットワークを知りたくて

⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ
 　　　　　　　　　　　　　○
 　　　　　　　　　　　о
 　　　　　　　　　　｡
 
 　　　　　　　　　　,､-､_　　＿_
 　　　　,､-―､_,､'´　　　￣　　`ヽ,
 　　　/　　　　　　 ・　　　 ．　　　ｌ、
 　　　ｌ,　　　　　　 ヾニニつ　　　　`ヽ、
 　　　 |　　　　　　　　　　　　　　　　　 `ヽ,
 　　　 ﾉ　　　　　　　　　　　　　　　　　　ノ
 　　 /::::　　　　　　　　　　　　　　　　　/
 　／:::::::　　　　　　　　　　　　　　　　..::l、
 /::::::::::::::::::......:::::::.　　　　　　　............::::::::::`l,
 l::::::::::::::::::::::::::::::::::::......　　　....:::::::::::::::::::::::::::::`l,
 ヽ,:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::ﾉ
 　　￣￣``ヽ､_:::::::::::::::::::::::,､-―´￣`ヽ､,､-'
 　　　　　　　　 `ヽ―-―'´

pi@raspberrypi:~ $ sudo go run main.go

$ sudo tcpdump -U -i eth0 -w - | /mnt/c/Program\ Files/Wireshark/Wireshark.exe -k -i -

# TLS v1.2 でリクエスト
$ curl -k -s -v --tls-max 1.2 https://192.168.10.112:10443

# TLS v1.3 でリクエスト
$ curl -k -s -v --tls-max 1.3 https://192.168.10.112:10443

# TLS v1.3 で cipher suites を指定してリクエスト（ただし、Client Hello の Cipher Suites のリストが、その指定のみになるわけではなく、一番上（最優先）にくるというもの（パケットキャプチャで確認））
$ curl -k -s -v --tls-max 1.3 --tls13-ciphers "TLS_CHACHA20_POLY1305_SHA256" https://192.168.10.112:10443

$ arping -c 1 1.2.3.4
ARPING 1.2.3.4 from 172.23.242.78 eth0
Sent 1 probes (1 broadcast(s))
Received 0 response(s)

$ nslookup -vc github.com

$ ip -6 route
$ ping -c 1 fe80::1

$ sudo go run cmd/packemon/main.go --send --debug --proto tcp-3way-http