Packet Batch

A collection of high-performance applications and tools designed for sending network packets. It serves two main purposes: penetration testing, which involves assessing network security by simulating various attacks like Denial of Service (DoS); and network monitoring, which involves analyzing and inspecting network traffic.

Among these applications, two stand out as they utilize AF_XDP (eXpress Data Path) and the DPDK (Data Plane Development Kit) technologies. AF_XDP is a fast and efficient network socket technology, while the DPDK is a kernel-bypass framework that allows for optimized packet processing in the user space.

By leveraging AF_XDP and the DPDK, these special applications can generate a significant amount of network traffic, making the most out of the available hardware resources.

With that said, if these applications are launched from multiple sources to the same network/IP address, it is considered a Distributed Denial of Service (DDoS) attack.

NOTE - This project was inspired by my previous Packet Sequence project. Packet Sequence only supports AF_PACKETv3 Linux sockets, though.

Disclaimer

I do NOT support using these tools maliciously. I made these tools for educational purposes and hope others may learn from them. Please use these tools responsibly.

Applications

As mentioned above, there are three applications for this project; Standard, AF_XDP, and DPDK.

• Standard - Utilizes AF_PACKETv3 Linux sockets and supports TCP cooked sockets for easy TCP connection establishing.
• AF_XDP - Uses AF_XDP Linux sockets which is faster than AF_PACKETv3, but doesn't support TCP cooked sockets.
• DPDK - Uses the DPDK which is faster than other applications, but since the DPDK is a kernel-bypass library, it is harder to setup and only supports certain hardware. The tool also doesn't support TCP cooked sockets.

Dependencies

• LibYAML - Used for parsing config files using the YAML syntax.

YAML Configuration

If you want to use more than one sequence, you will need to specify sequences inside of a config file using the YAML syntax. Please see the following for an explanation.

1# The interface to send packets out of.
2interface: myinterface
3
4sequences:
5    seq01:
6        # An array of other configs to include before this sequence. WARNING - If this is used, you must write this at the beginning of the sequence like this example. Otherwise, unexpected results will occur (e.g. the current sequence will be overwritten). This is empty by default and only showing as an example.
7        includes:
8            - /etc/pcktbatch/include_one.yaml
9            - /etc/pcktbatch/include_two.yaml
10
11        # If set, will use a specific interface for this sequence. Otherwise, uses the default interface specified at the beginning of the config.
12        interface: NULL
13
14        # If true, future sequences will wait until this one finishes before executing.
15        block: true
16
17        # The maximum packets this sequence can produce before terminating.
18        count: 0
19
20        # The maximum bytes this sequence can produce before terminating.
21        data: 0
22
23        # How long in seconds this sequence can go on before terminating.
24        time: 0
25
26        # The amount of threads to spawn with this sequence. If this is set to 0, it will use the CPU count (recommended).
27        threads: 0
28
29        # The delay between sending packets on each thread in microseconds.
30        delay: 1000000
31
32        # If true, even if 'count' is set to 0, the program will keep a packet counter inside of each thread. As of right now, a timestamp (in seconds) and a packet counter is used to generate a seed for randomness within the packet. If you want true randomness with every packet and not with each second, it is recommended you set this to true. Otherwise, this may result in better performance if kept set to false.
33        trackcount: false 
34        
35        # Ethernet header options.
36        eth:
37            # The source MAC address. If not set, the program will retrieve the MAC address of the interface we are binding to (the "interface" value).
38            #srcmac: NULL
39
40            # The destination MAC address. If not set, the program will retrieve the default gateway's MAC address.
41            #dstmac: NULL
42        
43        # IP header options.
44        ip:
45            # Source ranges in CIDR format. By default, these aren't set, but I wanted to show an example anyways. These will be used if 'srcip' is not set.
46            ranges:
47                - 172.16.0.0/16
48                - 10.60.0.0/24
49                - 192.168.30.0/24
50            
51            # The source IPv4 address. If not set, you will need to specify source ranges in CIDR format like the above. If no source IP ranges are set, a warning will be outputted to `stderr` and 127.0.0.1 (localhost) will be used.
52            #srcip: NULL
53
54            # The destination IPv4 address. If not set, the program will output an error. We require a value here. Otherwise, the program will shutdown.
55            #dstip: NULL
56
57            # The IP protocol to use. At the moment, the only supported values are udp, tcp, and icmp.
58            protocol: udp
59
60            # The Type-Of-Service field (8-bit integer).
61            tos: 0
62            
63            # The Time-To-Live field (8-bit integer). For static, set min and max to the same value.
64            ttl:
65                # Each packet generated will pick a random TTL. This is the minimum value within that range.
66                min: 0
67
68                # Each packet generated will pick a random TTL This is the maximum value within that range.
69                max: 0
70            
71            # The ID field. For static, set min and max to the same value.
72            id:
73                # Each packet generated will pick a random ID. This is the minimum value within that range.
74                min: 0
75
76                # Each packet generated will pick a random ID. This is the maximum value within that range.
77                max: 0
78
79            # If true, we will calculate the IP header's checksum. If your NIC supports checksum offload with the IP header, disabling this option may improve performance within the program.
80            csum: true
81
82        # If true, we will calculate the layer-4 protocol checksum (UDP, TCP, and ICMP).
83        l4csum: true
84
85        # UDP header options.
86        udp:
87            # The source port. If 0, the program will generate a random number between 1 and 65535.
88            srcport: 0
89
90            # The destination port. If 0, the program will generate a random number between 1 and 65535.
91            dstport: 0
92
93        # TCP header options.
94        tcp:
95            # The source port. If 0, the program will generate a random number between 1 and 65535.
96            srcport: 0
97
98            # The destination port. If 0, the program will generate a random number between 1 and 65535.
99            dstport: 0
100
101            # If true, will set the TCP SYN flag.
102            syn: false
103
104            # If true, will set the TCP ACK flag.
105            ack: false
106        
107            # If true, will set the TCP PSH flag.
108            psh: false
109
110            # If true, will set the TCP RST flag.
111            rst: false
112
113            # If true, will set the TCP FIN flag.
114            fin: false
115
116            # If true, will set the TCP URG flag.
117            urg: false
118
119            # If true, the socket will be setup as a cooked TCP socket. This establishes the three-way TCP handshake. WARNING - This makes the program ignore all of the headers. The only relevant information is the payload, destination IP, and port (must be static) when this is set to true.
120            # NOTE - This is only supported for the standard version.
121            usesocket: false
122
123        # ICMP header options.
124        icmp:
125            # The code to use with the ICMP packet.
126            code: 0
127
128            # The type to use with the ICMP packet.
129            type: 0
130
131        # Payload options.
132        payload:
133            # Random payload generation/length.
134            length:
135                # The minimum payload length in bytes (payload is randomly generated).
136                min: 0
137
138                # The maximum payload length in bytes (payload is randomly generated).
139                max: 0
140
141            # If true, the application will only generate one payload per thread between the minimum and maximum lengths and generate the checksums once. In many cases, this will result in a huge performance gain because generating random payload per packet consumes a lot of CPU cycles depending on the payload length.
142            isstatic: false
143
144            # If true, the application will read data from the file 'exact' (below) is set to. The data within the file should be in the same format as the 'exact' setting without file support which is hexadecimal and separated by a space (e.g. "FF FF FF FF 59").
145            isfile: false
146
147            # If true, will parse the payload (either in 'exact' or the file within 'exact') as a string instead of hexadecimal.
148            isstring: false
149
150            # If a string, will set the payload to exactly this value. Each byte should be in hexadecimal and separated by a space. For example: "FF FF FF FF 59" (5 bytes of payload data).
151            #exact: NULL

There are configuration examples here.

NOTE - The default config path is /etc/pcktbatch/pcktbatch.yaml. This may be changed via the -c and --cfg flags as explained under the Command Line Usage section below.

Command Line Usage

There are a number of command-line options available. Each tool has additional command-line usage. With that said, you may override the first sequence through the command-line which allows you to use the tools more easily for single-sequence layouts.

Basic

Basic command line usage may be found below.

1Usage: pcktbatch -c <configfile> [-v -h]
2
3-c --cfg => Path to YAML file to parse.
4-l --list => Print basic information about sequences.
5-v --verbose => Provide verbose output.
6-h --help => Print out help menu and exit program.

First Sequence Override

If you wanted to quickly send packets and don't want to create a YAML config file, you may specify command line options to override the first sequence. You must also specify the -z or --cli flag in order to do this.

The following command line options are available to override the first sequence.

1--interface => The interface to send out of.
2--block => Whether to enable blocking mode (0/1).
3--count => The maximum amount of packets supported.
4--time => How many seconds to run the sequence for maximum.
5--delay => The delay in-between sending packets on each thread.
6--data => The maximum amount of data (in bytes) we can send.
7--trackcount => Keep track of count regardless of it being 0 (read Configuration explanation for more information) (0/1).
8--threads => The amount of threads and sockets to spawn (0 = CPU count).
9--l4csum => Whether to calculate the layer-4 checksum (TCP, UDP, and ICMP) (0/1).
10
11--srcmac => The ethernet source MAC address to use.
12--dstmac => The ethernet destination MAC address to use.
13
14--minttl => The minimum IP TTL to use.
15--maxttl => The maximum IP TTL to use.
16--minid => The minimum IP ID to use.
17--maxid => The maximum IP ID to use.
18--srcip => The source IP (one range is supported in CIDR format).
19--dstip => The destination IP.
20--protocol => The protocol to use (TCP, UDP, or ICMP).
21--tos => The IP TOS to use.
22--l3csum => Whether to calculate the IP header checksum or not (0/1).
23
24--usrcport => The UDP source port.
25--udstport => The UDP destination port.
26
27--tsrcport => The TCP source port.
28--tdstport => The TCP destination port.
29--tsyn => Set the TCP SYN flag (0/1).
30--tack => Set the TCP ACK flag (0/1).
31--tpsh => Set the TCP PSH flag (0/1).
32--trst => Set the TCP RST flag (0/1).
33--tfin => Set the TCP FIN flag (0/1).
34--turg => Set the TCP URG flag (0/1).
35--tcpusesocket => Use TCP cooked socket (0/1).
36
37--pmin => The minimum payload data.
38--pmax => The maximum payload data.
39--pstatic => Use static payload (0/1).
40--pexact => The exact payload string.
41--pfile => Whether to parse a file as the 'pexact' string instead.
42--pstring => Parse the 'pexact' string or file as a string instead of hexadecimal.

Credits

• Christian Deacon