建站
咨詢
售后
建站咨詢
新聞中心
How to Modify Data Packets with Linux
成都創(chuàng)新互聯(lián)致力于成都網(wǎng)站設計、成都網(wǎng)站制作,成都網(wǎng)站設計,集團網(wǎng)站建設等服務標準化，推過標準化降低中小企業(yè)的建站的成本，并持續(xù)提升建站的定制化服務水平進行質(zhì)量交付，讓企業(yè)網(wǎng)站從市場競爭中脫穎而出。 選擇成都創(chuàng)新互聯(lián)，就選擇了安全、穩(wěn)定、美觀的網(wǎng)站建設服務！
Data packets are essential for the transfer of information over the internet. By default, data packets travel through the internet without any modification. However, sometimes it is necessary to modify certn elements of the data packet in order to achieve a specific result. In such a situation, Linux can be very useful as it offers numerous tools to modify data packets. In this article, we will explore how to use Linux to modify data packets.
What is a data packet?
A data packet is a unit of information that is tranitted over the internet. It contns a header and a payload. The header contns information such as the source and destination IP addresses, protocol number, and other optional fields. The payload contns the actual data being tranitted. Data packets are sent from one device to another over the internet, and they are received and reassembled into the original message by the receiving device.
Why modify data packets?
There are several reasons why one may want to modify data packets. For instance, modifying the value of the TTL (Time-To-Live) field in the header of a data packet can be useful if you want to prevent the data packet from reaching its final destination. Similarly, modifying the source and destination IP addresses can be useful for routing purposes. Moreover, modifying the payload of a data packet can be useful in cases where you want to manipulate the data being sent or received.
Tools to Modify Data Packets
In Linux, there are several tools that can be used to modify data packets. Here are some of the most popular tools:
1. Tcpdump: Tcpdump is a command-line tool that captures and displays packets tranitted over a network. It can also be used to yze and modify packet headers.
2. Scapy: Scapy is a Python-based tool that can be used to create, sniff, and manipulate network packets. It has a flexible and expressive syntax that allows for easy packet construction and modification.
3. Ncat: Ncat is a command-line tool that can be used to create, send, and receive data packets. It is part of the nmap security suite and is avlable for all major operating systems.
4. Wireshark: Wireshark is a graphical tool that can be used to capture and yze network packets. It can also be used to modify packet contents and headers.
Using Tcpdump to Modify Data Packets
Tcpdump is a very popular tool for capturing and yzing network packets. It can also be used to modify packet headers. Here’s an example of how to modify the TTL field of a packet using tcpdump:
1. Open a terminal and type the following command to start tcpdump:
$sudo tcpdump -i eth0 -v
2. Send a packet to your machine from another machine on your network.
3. When tcpdump captures the packet, press “Control+C” to stop tcpdump from capturing packets.
4. Type the following command to modify the TTL value of the packet:
$sudo tcpdump -r tcpdump.cap -w new.pcap ‘src X.X.X.X and dst X.X.X.X’ -e -XX ‘ip[8] = 0x32’
Here, X.X.X.X represents the source and destination IP addresses of the packet. The ip[8] = 0x32 part of the command sets the TTL value to 50 (0x32 in hex). The modified packet is saved in the new.pcap file.
Using Scapy to Modify Data Packets
Scapy is a powerful Python-based tool that can be used to create, sniff, and manipulate network packets. Here’s how to modify a packet using Scapy:
1. Open a terminal and type the following command to start Scapy:
$ sudo scapy
2. Create a new packet using the following command:
>>> pkt = IP(dst=”X.X.X.X”)/TCP(dport=80)/HTTP()/Raw(“Hello World”)
Here, X.X.X.X represents the destination IP address of the packet.
3. Modify the value of the TTL field using the following command:
>>> pkt[IP].ttl = 50
Here, 50 is the new value of the TTL field.
4. Send the modified packet using the following command:
>>> send(pkt)
Using Ncat to Modify Data Packets
Ncat is a command-line tool that can be used to create, send, and receive data packets. Here’s how to modify a packet using Ncat:
1. Open a terminal and type the following command to start Ncat:
$ ncat -lvp 4444
2. In another terminal, use the following command to send a packet to the Ncat listener:
$ echo “Hello World” | ncat localhost 4444
3. When Ncat receives the packet, you can modify its contents by piping the output to a text editor or other tool:
$ ncat -lvp 4444 | sed ‘s/Hello/Goodbye/g’ | ncat localhost 5555
Here, sed is used to modify the payload of the packet. The modified payload is sent to another instance of Ncat listening on port 5555.
Using Wireshark to Modify Data Packets
Wireshark is a popular graphical tool that can be used to capture and yze network packets. It can also be used to modify packet contents and headers. Here’s how to modify a packet using Wireshark:
1. Open Wireshark and start capturing packets.
2. Send a packet to your machine from another machine on your network.
3. When Wireshark captures the packet, right-click on it and select “Follow TCP Stream”.
4. In the Stream view, modify the contents of the packet and click “Save As” to save the modified packet to a file.
Conclusion
In this article, we explored how to use Linux to modify data packets. We discussed several tools, including tcpdump, Scapy, Ncat, and Wireshark, that can be used to modify packet contents and headers. It’s important to note that modifying data packets can have serious implications, and should only be done for legitimate purposes. When used responsibly, however, the ability to modify network packets can be a powerful tool for network administrators and security professionals.
成都網(wǎng)站建設公司-創(chuàng)新互聯(lián),建站經(jīng)驗豐富以策略為先導10多年以來專注數(shù)字化網(wǎng)站建設,提供企業(yè)網(wǎng)站建設,高端網(wǎng)站設計,響應式網(wǎng)站制作,設計師量身打造品牌風格,熱線:028-86922220linux在正常配置路由轉(zhuǎn)發(fā)功能，關閉防火墻，linux收到數(shù)據(jù)包后，還是無法轉(zhuǎn)發(fā)數(shù)據(jù)包
你只是增加了路由中的目的地，并沒有加需要到這個目的地去的數(shù)據(jù)所以轉(zhuǎn)發(fā)的網(wǎng)關，即你的上級路由陪歲
route add 114.215.195.176/32 gw 192.168.0.1 dev seth0 其中192.168.0.1就是你的上含畝級路由的ip，根據(jù)實蘆老睜際情況來改
Linux使用TPROXY進行UDP的透明代理
在進行TCP的代理時，只要在旁帶NET表上無腦進行REDIRECT就好了。例如使用ss-redir,你只要把tcp的流量redirect到ss-redir監(jiān)聽的端口上就OK了。但是當你使用這種方法的時候，就會不正常，因為對于UDP進行redirect之后，原始的目的地址和端口就找不到了。
這是為什么呢？
ss-redir的原理很簡單：使肆橋用iptables對PREROUTING與OUTPUT的TCP/UDP流量進行REDIRECT（REDIRECT是DNAT的特例），ss—redir在捕獲網(wǎng)絡流量后，通過一些技術手段獲取REDIRECT之前的目的地址（dst）與端口（port），連同網(wǎng)絡流量一起轉(zhuǎn)發(fā)至遠程服務器。
針對TCP連接，的確是因為Linux Kernel連接跟蹤機制的實現(xiàn)才使獲取
數(shù)據(jù)包
原本的dst和port成為可能，但這種連接跟蹤機制并非只存在于TCP連接中，UDP連接同樣存在，conntrack -p udp便能看到UDP的連接跟蹤記錄。內(nèi)核中有關TCP與UDP的NAT源碼/net/netfilter/nf_nat_proto_tcp.c和/net/netfilter/nf_nat_proto_udp.c幾乎一模一樣，都是根據(jù)NAT的類型做SNAT或DNAT。
那這究竟是怎么一回事？為什么對于UDP連接就失效了呢？
回過頭來看看ss-redir有關獲取TCP原本的dst和port的源碼，核心函數(shù)是getdestaddr：
在內(nèi)核源碼中搜了下有關SO_ORIGINAL_DST的東西，裂啟猛看到了getorigdst：
We only do TCP and SCTP at the moment。Oh，shit！只針對TCP與SCTP才能這么做，并非技術上不可行，只是人為地阻止罷了。
為了在redirect UDP后還能夠獲取原本的dst和port，ss-redir采用了TPROXY。Linux系統(tǒng)有關TPROXY的設置是以下三條命令：
大意就是在mangle表的PREROUTING中為每個UDP數(shù)據(jù)包打上0x2333/0x2333標志，之后在路由選擇中將具有0x2333/0x2333標志的數(shù)據(jù)包投遞到本地環(huán)回設備上的1080端口；對監(jiān)聽0.0.0.0地址的1080端口的socket啟用IP_TRANSPARENT標志，使IPv4路由能夠?qū)⒎潜緳C的數(shù)據(jù)報投遞到
傳輸層
，傳遞給監(jiān)聽1080端口的ss-redir。IP_RECVORIGDSTADDR與IPV6_RECVORIGDSTADDR則表示獲取送達數(shù)據(jù)包的dst與port。
可問題來了：要知道m(xù)angle表并不會修改數(shù)據(jù)包，那么TPROXY是如何做到在不修改數(shù)據(jù)包的前提下將非本機dst的數(shù)據(jù)包投遞到換回設備上的1080端口呢？
這個問題在內(nèi)核中時如何實現(xiàn)的，還待研究，但是確定是TPROXY做了某些工作。
TPROXY主要功能：
TPROXY要解決的兩個重要的問題
參考：
Linux修改iptables，開放端口？如何在文件中輸入規(guī)則
/etc/sysconfig/iptables 是iptables啟動時默認載入的配置文件
開發(fā)67端口，只需要該文件的:RH-Firewall-1-INPUT – 鏈中加入一條指令：
(iptables 不用寫入) -A INPUT -dport 67 -j ACCEPT
這里只匹配數(shù)據(jù)包的目標端口，不做協(xié)議匹配，也就說所有通過到達該端口的數(shù)據(jù)包都會被通過
要做其他如協(xié)議的匹配，加入 -p 協(xié)議名 即可。
=======================================
另外要提出的是：
直接 vi /etc/sysconfig/iptables 和在終端輸入iptables命令的區(qū)別：
/螞逗敗etc/sysconfig/iptables 是默認配置文件，每次iptables在啟動時都會載入里面的規(guī)則，但載入之后，實際上該文件沒有什么用處。也就是只有載入的時候有用。
在/etc/sysconfig/iptables-config 里面的IPTABLES_SAVE_ON_STOP=no 這一句的”no”改為”yes”這樣每次服務在停止之前會自動將現(xiàn)有的規(guī)則保存在 /etc/sysconfig/iptables 這個文件中去.等同于每次在停止iptables時 首先會執(zhí)行一個命令# iptables-save /etc/sysconfig/iptables
使用iptables命令輸入，規(guī)則立即生效，但并不是立即寫入/etc/sysconfig/iptables文件指者，只悶顫有執(zhí)行# iptables-save /etc/sysconfig/iptables 之后，現(xiàn)有規(guī)則才會被保存到/etc/sysconfig/iptables文件。
說的做吧，我盡量解釋清楚。
/etc/init.d/iptables start 啟動iptables
初始化iptables，刪除之前的規(guī)則，
iptables -F
iptables -X
iptables -Z
iptables -F -t nat
iptables -X -t nat
iptables -Z -t nat
允許SSH進入，要不然等下就連不上去了
iptables -A INPUT -p TCP –dportj ACCEPT
設置默認出入站的規(guī)則
iptables -P INPUT DROP
iptables -P OUTPUT ACCEPT
iptables -P FORWARD ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -m state –state ESTABLISHED,RELATED -j ACCEPT
載入相應的模塊
modprobe ip_tables
modprobe iptable_nat
modprobe ip_nat_ftp
modprobe ip_conntrack
modprobe ip_conntrack_ftp
配置默認的轉(zhuǎn)發(fā)規(guī)則
iptables -t nat -P PREROUTING ACCEPT
iptables -t nat -P POSTROUTING ACCEPT
iptables -t nat -P OUTPUT ACCEPT
允許圓脊內(nèi)網(wǎng)連接
iptables -A INPUT -i 內(nèi)網(wǎng)網(wǎng)卡名（比如eth1） -j ACCEPT
啟用轉(zhuǎn)發(fā)功能
echo “1” > /proc/sys/net/ipv4/ip_forward
配置源NAT，允許內(nèi)網(wǎng)通過主機nat上網(wǎng)，即所謂的網(wǎng)絡碰腔逗共享
iptables -t nat -A POSTROUTING -s 內(nèi)網(wǎng)網(wǎng)卡名 -o 外網(wǎng)網(wǎng)卡名 -j MASQUERADE
把FTP服務笑賣器映射到外網(wǎng)
iptables -t nat -A PREROUTING -p tcp -d 58.222.1.3 –dport-j DNAT –to 192.168.0.211:21
結束，別忘了保存
service iptables save
192.168.0.211的網(wǎng)關應該設成這成主機192.168.0.1。這樣就行了。
關于linux 修改數(shù)據(jù)包的介紹到此就結束了，不知道你從中找到你需要的信息了嗎 ？如果你還想了解更多這方面的信息，記得收藏關注本站。
成都創(chuàng)新互聯(lián)科技公司主營:網(wǎng)站設計、網(wǎng)站建設、小程序制作、成都軟件開發(fā)、網(wǎng)頁設計、微信開發(fā)、成都小程序開發(fā)、網(wǎng)站制作、網(wǎng)站開發(fā)等業(yè)務，是專業(yè)的成都做小程序公司、成都網(wǎng)站建設公司、成都做網(wǎng)站的公司。創(chuàng)新互聯(lián)公司集小程序制作創(chuàng)意，網(wǎng)站制作策劃，畫冊、網(wǎng)頁、VI設計，網(wǎng)站、軟件、微信、小程序開發(fā)于一體。
本文名稱：如何使用Linux修改數(shù)據(jù)包(linux修改數(shù)據(jù)包)
文章分享：http://m.fisionsoft.com.cn/article/cdscsgs.html
