Change the first protocol in the frame from `raw:` to `eth:ethertype:`.

xrkk commented 3 months ago

The pcap packets generated by fakenet-ng have the protocol raw: as the first protocol for each frame. This behavior is viewable without any issues in Wireshark. However, certain (internal) pcap parsing software cannot interpret it and require the modification of raw: to eth:ethertype: or something.

For instance, when viewing a packet generated by fakenet-ng in Wireshark, the approximate format is as follows:

Frame ...
    Encapsulation type: Raw IP (7)
    ....
    [Protocols in frame: raw:ip:tcp:tls]
    ....
Raw packet data
IPV4 ...
TCP ...
TLS ...

When the same data is captured by Wireshark, the format viewed in Wireshark is as follows:

Frame ...
    Encapsulation type: Ethernet (1)                  <= difference
    ....
    [Protocols in frame: eth:ethertype:ip:tcp:tls]    <= difference
    ....
Ethernet II ...                                       <= difference
IPV4 ...
TCP ...
TLS ...

I tried modifying the source code file fakenet\diverters\diverterbase.py by removing the linktype=dpkt.pcap.DLT_RAW parameter when creating the dpkt.pcap.Writer so that the linktype takes the default value dpkt.pcap.DLT_EN10MB. However, the format of the generated packets is as follows:

Frame ...
    Encapsulation type: Ethernet (1)
    ....
    [Protocols in frame: eth:ethertype:data]        <= difference
    ....
Ethernet II ...
Data ...                                            <= difference

I would like to know how to modify the source code or configuration to make fakenet-ng generate packets where the first protocol of the frame is eth:ethertype: instead of raw:.

THX!

mr-tz commented 2 months ago

@3V3RYONE, @strictlymike do you have insights here?

mr-tz commented 2 months ago

or @tinajn?

xrkk commented 2 months ago

@mr-tz Thank you for your attention. Actually this is solved by below code:

from scapy.utils import rdpcap
from scapy.utils import wrpcap
from scapy.layers.l2 import Ether

f_pcap = '/path/to/src/pcap'
f_dst = '/path/to/dst/pcap'

packets = rdpcap(f_pcap)
eth_ipv4 = Ether(src="00:11:22:33:44:55", dst="aa:bb:cc:dd:ee:ff", type=0x0800)

converted_packets = []
for idx, pkt in enumerate(packets):
    new_pkt = eth_ipv4 / pkt.getlayer(0)
    converted_packets.append(new_pkt)
wrpcap(f_dst, converted_packets, linktype=1)

Again, thank you for your great work!

mandiant / flare-fakenet-ng

Change the first protocol in the frame from `raw:` to `eth:ethertype:`. #179