Packet crafting is the process of taking a typical packet from a known protocol such as TCP or IP, and manipulating its options for security testing purposes. Because devices on a network are designed to follow the rules of TCP/IP, when confronted with an unexpected packet, they might behave abnormally. The results could be anything from DoS caused by unprocessable packets, to evading intrusion detection, to testing firewalls for vulnerabilities. Typical packet crafting techniques include:

  • Raising TCP flags in an unusual or illogical manner.
  • Changing source or destination ports.
  • Spoofing IP or MAC addresses.
  • Changing TCP sequence or acknowledgment numbers.
  • Changing IP fragment offsets.
  • Changing the Time-to-Live (TTL) value.
  • Changing Quality of Service (DSCP) values.

Nmap can perform some packet crafting. There are also a number of tools specifically designed for packet crafting. Examples include:

  • hping3
  • Ostinato
  • Scapy
  • Libcrafter
  • Yersinia
  • packETH
  • Colasoft Packet Builder
  • Bit-Twist