DNET(8) BSD System Manager's Manual DNET(8)
NAME
dnet(3,8) -- dumb networking library test program
SYNOPSIS
dnet(3,8) command args [...]
DESCRIPTION
dnet(3,8) is a simple test program for the dnet(3,8)(3) library. It can be used to
compose and transmit network datagrams as a Unix-style filter(1,3x,3x curs_util) (e.g. read-
ing from or writing to files and pipes) or modify the local system net-
work configuration (including the ARP cache, firewall ruleset, network
interfaces, and routing table).
Payload generation commands
addr address [...]
Convert the address (specified as a hostname, IP address, or MAC
address) into its binary representation on standard output.
hex string(3,n) [...]
Convert the C-style escaped string(3,n) (shellcode, for instance) into
its binary representation on standard output.
rand(1,3) len
Write len random(3,4,6) bytes to standard output.
Packet encapsulation commands
eth [type type] [src mac] [dst mac]
Prepend the data read(2,n,1 builtins) from standard input with an Ethernet header on
standard output. The Ethernet type may be specified as `arp(7,8)', `ip(7,8)',
or as a hex, octal, or decimal number.
arp(7,8) [op op] [sha(1,3,1 dgst) mac] [spa host(1,5)] [tha mac] [tpa host(1,5)]
Prepend the data read(2,n,1 builtins) from standard input with an ARP header on
standard output. The ARP op may be specified as `req', `rep',
`revreq', `revrep', or as a hex, octal, or decimal number.
ip(7,8) [tos num] [id num] [off offset] [ttl num] [proto protocol] [src host(1,5)]
[dst dst]
Prepend the data read(2,n,1 builtins) from standard input with an IP header on stan-
dard output. The fragmentation offset may be specified as a decimal
number (optionally concatenated with `+' to indicate more fragments)
or as a hex number. The protocol may be specified by name, or as a
hex, octal, or decimal number.
icmp [type num] [code num]
Prepend the data read(2,n,1 builtins) from standard input with an ICMP header on
standard output.
tcp [sport port] [dport port] [flags flags] [seq num] [ack num] [win num]
[urp num]
Prepend the data read(2,n,1 builtins) from standard input with a TCP header on stan-
dard output. A port may be specified by name or hex, octal, or deci-
mal number. The TCP flags may be specified as some combination of
the characters in(1,8) the set(7,n,1 builtins) `SAFRPU' or as a hex number.
udp [sport port] [dport port]
Prepend the data read(2,n,1 builtins) from standard input with a UDP header on stan-
dard output. A port may be specified by name or hex, octal, or deci-
mal number.
Packet transmission commands
send(2,n) [device]
Read a packet from standard input and send(2,n) it over the network. If
no device is specified, the packet is assumed to be an IP datagram
and routed to its destination. Otherwise, the packet is assumed to
be an Ethernet frame and is transmitted on the specified interface.
Kernel interface commands
arp(7,8) show
Display the kernel ARP cache.
arp(7,8) get host(1,5)
Display the kernel ARP entry for host(1,5).
arp(7,8) add host(1,5) mac
Add an ARP entry mapping the mac address for host(1,5).
arp(7,8) delete host(1,5)
Delete the ARP entry for host(1,5).
fw show
Display the kernel firewall ruleset.
fw add|delete action direction device protocol src[:port[-max]]
dst[:port[-max]] [type[/code]]
Add a rule to or delete a rule from the active firewall ruleset. The
action must be either `allow' or `block'. The direction must be
either `in(1,8)' or `out'. The device may specify an interface name, or
`any'. The protocol may be specified by name, or as a decimal num-
ber. For TCP and UDP protocols, a port (or range, if(3,n) specified with
a max value) may be specified in(1,8) decimal and appended to the source
and/or destination address. For ICMP, a type (and optional code) may
be specified in(1,8) decimal.
intf show
Display the configuration of all network interfaces.
intf get device
Display the configuration for the interface specified by device.
intf set(7,n,1 builtins) device [alias host(1,5)] [dst host(1,5)] [inet host(1,5)] [link(1,2) mac] [up|down]
[arp(7,8)|noarp]
Configure the interface specified by device.
route show
Display the kernel routing table.
route get dst
Display the route for the destination dst, specified as a hostname,
IP address, or network prefix in(1,8) CIDR notation.
route add dst gw
Add a route for the destination dst through the gateway gw.
route delete dst
Delete the route for the destination dst.
EXAMPLES
Send a UDP datagram containing random(3,4,6) shellcode:
dnet(3,8) hex "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89" \
"\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80" \
"\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh" | \
dnet(3,8) udp sport 555 dport 666 | \
dnet(3,8) ip(7,8) proto udp src 1.2.3.4 dst 5.6.7.8 | dnet(3,8) send(2,n)
Save an ARP request in(1,8) a file(1,n) and send(2,n) it twice:
dnet(3,8) arp(7,8) op req sha(1,3,1 dgst) 0:d:e:a:d:0 spa 10.0.0.3 tpa 10.0.0.4 | \
dnet(3,8) eth type arp(7,8) src 0:d:e:a:d:0 dst ff:ff:ff:ff:ff:ff > arp.pkt
dnet(3,8) send(2,n) fxp0 < arp.pkt
dnet(3,8) send(2,n) fxp0 < arp.pkt
Send a fragmented ping packet:
# Create ping packet with IP header, to set(7,n,1 builtins) ICMP checksum
echo(1,3x,1 builtins) "monkey monkey monkey monkey" | dnet(3,8) icmp type 8 code 0 | \
dnet(3,8) ip(7,8) proto icmp src 1.2.3.4 dst 5.6.7.8 > ping.pkt
# Chop off IP header
dd if(3,n)=ping.pkt of=ping.data bs=20 skip=1
# Fragment IP payload
split(1,n) -b 24 ping.data p.
# Send fragments
dnet(3,8) ip(7,8) id 1 off 0+ proto icmp src 1.2.3.4 dst 5.6.7.8 < p.aa | \
dnet(3,8) send(2,n)
dnet(3,8) ip(7,8) id 1 off 24 proto icmp src 1.2.3.4 dst 5.6.7.8 < p.ab | \
dnet(3,8) send(2,n)
SEE ALSO
dnet(3,8)(3)
AUTHORS
Dug Song <dugsong@monkey.org>
BSD October 17, 2001 BSD