Feature request: Hiding from wireshark/tcpdump

f0rb1dd3n / Reptile

LKM Linux rootkit

2.54k stars 572 forks source link

Feature request: Hiding from wireshark/tcpdump #10

Open mayank265 opened 6 years ago

mayank265 commented 6 years ago

Hi,

Could you add another feature to this rootkit so that it can hide its packets from tools like wireshark/tcpdump?

f0rb1dd3n commented 6 years ago

Hello,

I will do that as soon as possible. That already is on my roadmap when I have time to code. ;)

pyperanger commented 6 years ago

I'm really excited to see this working 403, is it anything that involves Hook pcaplib or something like that?

f0rb1dd3n commented 6 years ago

Hello Pype, is good to see you here. I am very busy lately. Then, I forgot Reptile for a while.

Libpcap is a user land library and I am intended to do that in kernel land. So, I can use netfilter hooks to manipulate packets in kernel land before sending it to user land.

seeya bro! :)

LevitatingBusinessMan commented 3 years ago

@f0rb1dd3n Do you still have plans for adding this feature?