# Packémon
[](https://github.com/caesar0301/awesome-pcaptools?tab=readme-ov-file#traffic-analysisinspection) [![version](https://img.shields.io/github/v/release/ddddddO/packemon?style=flat-square&logo=git&logoColor=3BAF75&labelColor=EEE&color=3BAF75")](https://github.com/ddddddO/packemon/releases) [](https://deepwiki.com/ddddddO/packemon)
Packet monster, or `Packémon` for short! (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ)
https://github.com/user-attachments/assets/08f96575-7aca-47e7-bdeb-6705ce2bbaba
TUI tool for generating packets of arbitrary input and monitoring packets on any network interfaces (default: `eth0`). The list of interfaces to be specified is output when `packemon interfaces` is run.
**This tool works on Windows, macOS, and Linux.**
This TUI tool is now available on macOS because of **[cluster2600](https://github.com/cluster2600)** support. Thanks🎉!
I intend to develop it patiently🌴
The images of Packemon on REDME should be used as reference only, as they may look different from the actual Packemon.
> [!WARNING]
> This tool is implemented with protocol stacks from scratch and utilizes raw socket.
> There may be many bugs. If you find a bug, I would be glad if you raise an issue or give me a pull request!
## Feature - Overview
This TUI tool has two major functions: packet generation and packet monitoring.
|Generated DNS query
and Recieved response| Displayed DNS response detail|Filtered packets|
|--|--|--|
||||
This image shows packemon running in Generator / Monitor mode.
DNS query packet generated by Generator on the left is shown in **56** line of the Monitor. DNS query response packet is shown as **57** line, and a more detailed view of it is shown in the middle image.
See **[here](https://github.com/ddddddO/packemon#sending-dns-query-and-monitoring-dns-response)** for detailed instructions.
Packemon's Monitor allows user to select each packet by pressing `Enter` key. Then, select any line and press `Enter` key to see the details of the desired packet. Pressing `Esc` key in the packet detail screen will return you to the original packet list screen.
The rightmost image shows how the packet list is filtered.
## Feature - *Generator*
### Send generated packets to any network interfaces.
- You can specify network interface with `--interface` flag. Default is `eth0`.
### Packets of various protocols are supported.
details
- [x] Ethernet
- [x] IEEE802.1Q(VLAN tag)
- [x] ARP
- [x] IPv4
- [x] IPv6
- [x] ICMPv4
- [ ] ICMPv6
- [x] TCP
- [x] UDP
- [x] TLSv1.2
- **Implementation using Go standard package** (The following are valid fields;)
- IPv4: `Source IP Addr`, `Destination IP Addr`
- IPv6: `Source IP Addr`, `Destination IP Addr`
- TCP: `Source Port`, `Destination Port`, `Do TCP 3way handshake ?`(Check required)
- HTTP: All fields
- **Experimental implementation (full scratch)**
- This tool is not very useful because the number of cipher suites it supports is still small, but an environment where you can try it out can be found [here](./cmd/debugging/https-server/README.md).
- TCP 3way handshake ~ TLS handshake ~ TLS Application data (encrypted HTTP)
- Supported cipher suites include
- `TLS_RSA_WITH_AES_128_GCM_SHA256`
- You can check the server for available cipher suites with the following command
- `nmap --script ssl-enum-ciphers -p 443 `
- [x] TLSv1.3
- **Implementation using Go standard package** (The following are valid fields;)
- IPv4: `Source IP Addr`, `Destination IP Addr`
- IPv6: (Not available... Coming soon!)
- TCP: `Source Port`, `Destination Port`, `Do TCP 3way handshake ?`(Check required)
- HTTP: All fields
- **Experimental implementation (full scratch)**
- This tool is not very useful because the number of cipher suites it supports is still small, but an environment where you can try it out can be found [here](./cmd/debugging/https-server/README.md).
- TCP 3way handshake ~ TLS handshake ~ TLS Application data (encrypted HTTP)
- Supported cipher suites include
- `TLS_CHACHA20_POLY1305_SHA256`
- [x] QUIC (**Using [github.com/quic-go/quic-go](https://github.com/quic-go/quic-go)**. The following are valid fields;)
- IPv4: `Source IP Addr`, `Destination IP Addr`
- IPv6: `Source IP Addr`, `Destination IP Addr`
- UDP: `Source Port`, `Destination Port` (UDP selection required)
- QUIC: All fields
- HTTP: All fields
- 🥳< HTTP/3!
- [x] DNS (WIP)
- [x] HTTP (WIP)
- [ ] xxxxx....
- [ ] Routing Protocols
- IGP (Interior Gateway Protocol)
- [ ] OSPF (Open Shortest Path First)
- [ ] EIGRP (Enhanced Interior Gateway Routing Protocol)
- [ ] RIP (Routing Information Protocol)
- EGP (Exterior Gateway Protocol)
- [ ] BGP (Border Gateway Protocol)
- [Currently there is only debug mode](./cmd/debugging/bgp/README.md)
- TCP 3way handshake ~ Open ~ Keepalive ~ Update ~ Notification
> $ **sudo mount -t debugfs none /sys/kernel/debug** (only once)
> $ **sudo cat /sys/kernel/debug/tracing/trace_pipe**
## Feature - *Monitor*
### Monitor any network interfaces.
- You can specify network interface with `--interface` flag. Default is `eth0`.
### Can view details for L5 and higher.
- You can view details at the L5 level or higher by specifying the `--parse-full` flag.
- However, there are currently few supported protocols, and development progress has been slow...
- If you do not specify this flag, the parse results up to L4 will be displayed (though a full dump will still be shown).
### Can filter packets to be displayed.
- You can filter the values for each item (e.g. `Dst`, `Proto`, `SrcIP`...etc.) displayed in the listed packets.
### Specified packets can be saved to pcapng file.
### Packets of various protocols are supported.
details
- [x] Ethernet
- [x] IEEE802.1Q(VLAN tag)
- [x] ARP
- [x] IPv4 (WIP)
- [x] IPv6 (WIP)
- [x] ICMPv4 (WIP)
- [ ] ICMPv6
- [x] TCP (WIP)
- [x] UDP
- [x] TLSv1.2 (WIP)
- [ ] TLSv1.3
- [ ] DNS (WIP)
- [x] DNS query
- [x] DNS query response
- [ ] xxxxx....
- [ ] HTTP (WIP)
- [x] HTTP GET request
- [x] HTTP GET response
- [ ] xxxxx....
- [ ] xxxxx....
- [ ] Routing Protocols
- IGP (Interior Gateway Protocol)
- [ ] OSPF (Open Shortest Path First)
- [ ] EIGRP (Enhanced Interior Gateway Routing Protocol)
- [ ] RIP (Routing Information Protocol)
- EGP (Exterior Gateway Protocol)
- [ ] BGP (Border Gateway Protocol)
$ git clone git@github.com:ddddddO/packemon.git
$ cd packemon
(For Linux)
$ cd tc_program/ && go generate && cd -
(For Linux or macOS)
$ go build -o packemon cmd/packemon/*.go
$ ls | grep packemon
$ mv packemon /usr/local/bin/
(For Windows)
$ go build -o packemon.exe .\cmd\packemon\
### Package manager
> [!IMPORTANT]
> It might be that the generation of the executable file is failing. At that time, install it in another way!
For arm64, convert “amd64” to “arm64” in the following commands and execute them.
deb
$ export PACKEMON_VERSION=X.X.X
$ curl -o packemon.deb -L https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.deb
$ dpkg -i packemon.deb
rpm
$ export PACKEMON_VERSION=X.X.X
$ (Ubuntu) yum install https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.rpm
or
$ (Fedora) dnf install https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.rpm
apk
$ export PACKEMON_VERSION=X.X.X
$ curl -o packemon.apk -L https://github.com/ddddddO/packemon/releases/download/v$PACKEMON_VERSION/packemon_$PACKEMON_VERSION-1_amd64.apk
$ apk add --allow-untrusted packemon.apk
Homebrew
$ brew install ddddddO/tap/packemon
AUR
https://aur.archlinux.org/packages?K=packemon
Confirmed executable in the following environments
- OS: Debian GNU/Linux 12 (bookworm) on WSL2
- Kernel: 5.15.167.4-microsoft-standard-WSL2
- Architecture: x86_64
- OS: Ubuntu 22.04.3 LTS on WSL2
- Kernel: 5.15.167.4-microsoft-standard-WSL2
- Architecture: x86_64
- OS: Fedora Linux 42 on WSL2
- Kernel: 5.15.167.4-microsoft-standard-WSL2
- Architecture: x86_64
- OS: Debian GNU/Linux 12 (bookworm) on Google Pixel 7a
- Kernel: 6.1.0-34-arm64
- Architecture: aarch64
- OS: macOS
- OS: Windows 11 Pro
- Confirm MAC address of default gateway (via PowerShell)
```console
PS > $defaultGateway = (Get-NetRoute -DestinationPrefix "0.0.0.0/0" | Sort-Object -Property InterfaceMetric | Select-Object -First 1).NextHop
PS > echo $defaultGateway
192.168.10.1
PS > Get-NetNeighbor -IPAddress $defaultGateway | Select-Object -ExpandProperty LinkLayerAddress
```
cmd
- OS: `cat /etc/os-release`
- Kernel: `uname -r`
- Architecture: `uname -m`
$ go install github.com/ddddddO/packemon/cmd/packemon@latest
## Usage - Overview
```console
$ packemon --help
NAME:
packemon - Packet monster (っ‘-’)╮=͟͟͞͞◒ ヽ( '-'ヽ) TUI tool for sending packets of arbitrary input and monitoring packets on any network interfaces (default: eth0). Windows/macOS/Linux
⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ⌒丶、＿ノ
○
о
｡
,､-､_ ＿_
,､-―､_,､'´ ￣ `ヽ,
/ ・ ． ｌ、
ｌ, ヾニニつ `ヽ、
| `ヽ,
ﾉ ノ
/:::: /
／::::::: ..::l、
/::::::::::::::::::......:::::::. ............::::::::::`l,
l::::::::::::::::::::::::::::::::::::...... ....:::::::::::::::::::::::::::::`l,
ヽ,:::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::ﾉ
￣￣``ヽ､_:::::::::::::::::::::::,､-―´￣`ヽ､,､-'
`ヽ―-―'´
USAGE:
packemon [global options] [command [command options]]
VERSION:
1.X.Y / revision zzzzzzz
COMMANDS:
monitor, m, mon Monitor mode. You can monitor packets received and sent on the specified interface. Default is 'eth0' interface.
generator, g, gen Generator mode. Arbitrary packets can be generated and sent.
interfaces, i, intfs Check the list of interfaces.
debugging, d, debug Debugging mode.
version, v Prints the version.
help, h Shows a list of commands or help for one command
GLOBAL OPTIONS:
--help, -h show help
--version, -v print the version
$
```
## Usage - *Generator*
```console
$ sudo setcap cap_net_raw,cap_bpf,cap_sys_admin,cap_net_admin+ep /path/to/packemon
$ packemon generator
```
or
```console
$ sudo packemon generator
```
## Usage - *Monitor*
```console
$ sudo setcap cap_net_raw+ep /path/to/packemon
$ packemon monitor
```
or
```console
$ sudo packemon monitor
```
## Usecase - Overview
### Network Learning and Education
Packemon serves as an educational tool for understanding network protocols by allowing hands-on experimentation. You can generate custom packets at different OSI layers and observe their behavior, making it ideal for learning TCP/IP fundamentals.
### Protocol Development and Testing
The tool supports testing custom protocol implementations across multiple layers including Ethernet, ARP, IPv4/IPv6, ICMP, TCP/UDP, TLS, DNS, and HTTP. This makes it valuable for developers working on network protocol stacks or testing protocol compliance.
### Network Troubleshooting and Analysis
Packemon provides packet monitoring capabilities similar to Wireshark, allowing you to capture and analyze network traffic in real-time. You can filter packets, examine protocol details, and export captured data to pcapng format for further analysis.
### Security Research and Penetration Testing
The tool can be used for security research, including testing for vulnerabilities like DNS reflection attacks.
### Custom Network Tool Development
Packemon demonstrates how to build network tools from scratch, serving as a reference implementation for developers creating their own packet manipulation utilities.
## Usecase - Sending DNS query and Monitoring DNS response
process
1. setup
```sh
# Generator
$ sudo packemon generator
```
```sh
# Monitor
$ sudo packemon monitor --parse-full
```
← Generator | Monitor →
2. Generator
- `Lα` > `Ethernet` > `Ether Type` > **IPv4**
- `Lβ` > `IPv4` > `Protocol` > **UDP**
- `Lβ` > `IPv4` > `Destination IP Addr` > **1.1.1.1**
- Enter the address of DNS resolver here. Above is the address of Cloudflare resolver.
- `Lγ` > `UDP` > `Destination Port` > **53**
- `Lγ` > `UDP` > `Automatically calculate length ?` > **(Check!)**
- `Lε` > `DNS` > `Queries Domain` > **go.dev**
- Enter here the domain for which you want to name resolution.
- `Lε` > `DNS` > Click on **Send!**
- At this time, DNS query is sent with the contents set so far.
3. Monitor
- Find records where `Proto`: **DNS** and `DstIP` or `SrcIP` is **1.1.1.1**. Select each record to see the packet structure of the DNS query and the packet structure of the DNS response.
- List
- DNS query (`DstIP: 1.1.1.1`)
- DNS response (`SrcIP: 1.1.1.1`)
details
||Description|How to do it in Pakemon (Generator)|
|--|--|--|
|ARP Scan|On a local network, broadcast an ARP request to identify the host that responds. Verify the association between the IP address and MAC address.|Currently, Packemon does not support specifying IP address ranges for requests, so you have to specify each one individually...
- `Lα` > `Ethernet` > `Destination Mac Addr` > `0xffffffffffff`
- `Lα` > `Ethernet` > `Ether Type` > `ARP`
- `Lβ` > `ARP` > `Hardware Type` > `0x0001`
- `Lβ` > `ARP` > `Protocol Type` > `0x0800`
- `Lβ` > `ARP` > `Hardware Size` > `0x06`
- `Lβ` > `ARP` > `Protocol Size` > `0x04`
- `Lβ` > `ARP` > `Operation Code` > `0x0001`
- `Lβ` > `ARP` > `Target Mac Addr` > `0x000000000000`
- `Lβ` > `ARP` > `Target IP Addr` > (Target IP Addr)
- `Lβ` > `ARP` > Click on `Send!`|
|Ping Sweep|Send ICMP echo requests to multiple IP addresses on the network to identify the hosts that return echo replies. This is a simple and widely used technique.|Currently, Packemon does not support specifying IP address ranges for requests, so you have to specify each one individually...
- `Lα` > `Ethernet` > `Ether Type` > `IPv4`
- `Lβ` > `IPv4` > `Protocol` > `ICMP`
- `Lβ` > `IPv4` > `Destination IP Addr` > (Target IP Addr)
- `Lγ` > `ICMP` > `Type` > `0x08`
- `Lγ` > `ICMP` > Click on `Send!`|
details
||Description|How to do it in Pakemon (Generator)|
|--|--|--|
|TCP Connect Scan|This is the most basic scanning method, which verifies whether a port is open by performing a complete TCP three-way handshake (SYN -> SYN/ACK -> ACK).|- `Lα` > `Ethernet` > `Ether Type` > `IPv4`
- `Lβ` > `IPv4` > `Protocol` > `TCP`
- `Lβ` > `IPv4` > `Destination IP Addr` > (Target IP Addr)
- `Lγ` > `TCP` > `Do TCP 3way handshake ?` > (Check!)
- `Lγ` > `TCP` > `Destination Port` > (Target Port)
- `Lγ` > `TCP` > Click on `Send!`|
|SYN Scan (Half-open Scan)|This technique checks port availability without completing the TCP handshake. It sends a SYN packet; if a SYN/ACK packet is returned, the port is deemed open. It then sends a RST packet to reset the connection. Because it leaves minimal traces in logs, it is also called a stealth scan.|When using Packemon on Linux, since it drops RST packets, I only wrote the procedure for sending Syn packets.
- `Lα` > `Ethernet` > `Ether Type` > `IPv4`
- `Lβ` > `IPv4` > `Protocol` > `TCP`
- `Lβ` > `IPv4` > `Destination IP Addr` > (Target IP Addr)
- `Lγ` > `TCP` > `Do TCP 3way handshake ?` > (No Check!)
- `Lγ` > `TCP` > `Flags` > `0x02`
- `Lγ` > `TCP` > `Destination Port` > (Target Port)
- `Lγ` > `TCP` > Click on `Send!`|
|UDP Scan|Because it uses the connectionless UDP protocol, it is well-suited for verifying whether a UDP port is open or closed. It sends a UDP packet and determines that the port is open if there is no ICMP Port Unreachable (Type 3, Code 3) response.|- `Lα` > `Ethernet` > `Ether Type` > `IPv4`
- `Lβ` > `IPv4` > `Protocol` > `UDP`
- `Lβ` > `IPv4` > `Destination IP Addr` > (Target IP Addr)
- `Lγ` > `UDP` > `Destination Port` > (Target Port)
- `Lγ` > `UDP` > Click on `Send!`|
details
||Description|How to do it in Pakemon (Generator)|
|--|--|--|
|Automated Scanners|Using tools such as Nessus and OpenVAS, we perform automated scans based on known vulnerability databases.|-|
|Banner Grabbing|Connect to the port and retrieve the “banner” returned by the service (e.g., web server version information) to check for known vulnerabilities.|-|
details
||Description|How to do it in Pakemon (Generator)|
|--|--|--|
|OS Fingerprinting|This technique identifies the target host's operating system by analyzing TCP/IP packet characteristics such as TTL values and window sizes.|-|
|Port Redirection|This scan verifies settings for forwarding packets to different ports or hosts.|-|
thanks!
## Document
- [ネットワークを知りたくて](https://zenn.dev/openlogi/articles/195d07bd9bc5b4)
## Stargazers over time
[](https://starchart.cc/ddddddO/packemon)
## Log (japanese)
xxx
## Links
- 「Golangで作るソフトウェアルータ」
- その実装コード: https://github.com/sat0ken/go-curo
- https://terassyi.net/posts/2020/03/29/ethernet.html
- 動作確認用コマンドの参考
- https://zenn.dev/takai404/articles/76d47e944d8e18
- [Scrapboxメモ書き](https://scrapbox.io/ddddddo/%E3%83%8D%E3%83%83%E3%83%88%E3%83%AF%E3%83%BC%E3%82%AF%E7%B3%BB%E8%AA%AD%E3%81%BF%E7%89%A9)
- WSL2のDebianで動作した。
- 任意の Ethernet ヘッダ / IPv4 ヘッダ / ARP / ICMP を楽に作れてフレームを送信できる
- 以下はtmuxで3分割した画面に各種ヘッダのフォーム画面を表示している。そして ICMP echo request を送信し、 echo reply が返ってきていることを Wireshark で確認した様子
- フレームを受信して詳細表示（ARPとIPv4）
少し前のUI（`5062561` のコミット）
xxx
- Ethernetフレームのみ作って送信（`77c9149` でコミットしたファイルにて）
- ARPリクエストを作って送信（`390f266` でコミットしたファイルにて。中身はめちゃくちゃと思うけど）
- ARPリクエストを受信してパース（`b6a025a` でコミット）
