Packiffer
Packiffer is a lightweight cross-platform networking toolkit that let you sniff/analyze/inject/filter packets.
Features:
-display list of network interfaces
-sniff packets live from interface
-set promiscuous mode on interface
-apply filters to packets
-transform selected packets from pcap file to another
-inspect packets in terminal
-inject packets into network
-filter packets with specified destination ip
Modes:
Sniff:
sniff packets live from interface
Transform:
transform packets from offline pcap
Inspect:
inspect & analysis packets from offline pcap files
Inject:
Inject Raw & Constructed Packets
Filter:
Drop or Accept Packets
Prerequisites For Binary
Libpcap v1.9.1
Clang/LLVM (Only on Linux for eBPF XDP packet filtering)
Iptables (Only on Linux for Iptables packet filtering)
Prerequisites For Source
Golang v1.16
GoPacket v1.1.19
Go eBPF v0.0.0-20210223
Libpcap v1.9.1
Fiber v2.8.0
Clang/LLVM (Only on Linux for eBPF XDP packet filtering)
Iptables (Only on Linux for Iptables packet filtering)
How to get Packiffer
Checkout packiffer git repo using git clone
git clone https://github.com/massoudasadi/packiffer.git
cd packiffer
Run Packiffer
Sniff mode:
make build_go
./packiffer sniff <parameters>
("i", "Specify interface name. Default is eth0")
("p", "Specify promiscuous mode. Default is false")
("f", "Specify filter query. Default is all")
("od", "Specify output directory. Defaultis packiffer directory")
("of", "Specify output file name. Defaultis interface name")
("sl", "Specify Snapshot Lenght. Default is 2014")
("t", "limit sniffing timeout. Default is 30 seconds")
("c", "Limit count of packets to sniff. Default is 1000")
transform mode:
make build_go
./packiffer transform <parameters>
("f", "Specify filter query. Default is all")
("in", "Specify input pcap file")
("od", "Specify output directory.Default is packiffer directory")
("of", "Specify output file name.Default is interface name")
("c", "Limit count of packets to sniff. Default is1000")
inspect mode:
make build_go
./packiffer inspect <parameters>
("in", "Specify input pcap file")
("f", "Specify filter query. Default is all")
("c", "Limit count of packets to sniff. Default is 1000")
inject mode:
make build_go
./packiffer inject <parameters>
("i", "Specify interface name. Default is eth0")
("ir", "Specify Raw Packet Inject. Default is false")
("ic", "Specify Constructed Packet Inject. Default is False")
("f", "Specify Path to packet file. Default is inject.txt")
firewall mode:
make build_bpf
make build_go
./packiffer firewall <parameters>
("i", "Specify interface name. Default is eth0")
("f", "Specify Path to firewall file. Default is firewall.txt")
default mode:
./packiffer <parameters>
("h", "Specify help display. Default is false")
("d", "Specify devices display. Default is false")
Examples
Display list of network interfaces
./packiffer -d
Sniff packets on 'eth0' and save packets in 'eth0.pcap' (promiscuous mode) until Ctrl+C pressed
./packiffer sniff -i eth0 -p
transformonly udp packets from 'eth0.pcap' to 'eth0_udp.pcap' until Ctrl+C pressed
./packiffer transform -in /path/to/eth0.pcap -of eth0_udp
inspect only tcp packets from pcap file
./packiffer inspect -in /path/to/file.pcap -f tcp
inject constructed tcp packets from InjectConstructed.json
./packiffer inject -i eth0 -ic -f /path/to/file.json
filter packets from ips inside firewall.txt
./packiffer firewall -i eth0 -f /path/to/file.txt