Rewriting Live TCP/IP (Layer 4) Streams

Posted by user213060 on Stack Overflow See other posts from Stack Overflow or by user213060
Published on 2010-04-01T22:01:40Z Indexed on 2010/04/02 13:33 UTC
Read the original article Hit count: 156

I want to rewrite TCP/IP streams. Ettercap's etterfilter command lets you perform simple live replacements of TCP/IP data based on fixed strings or regexes. Example:

 if (ip.proto == TCP && tcp.dst == 80) {
    if (search(DATA.data, "gzip")) {
       replace("gzip", "    ");
       msg("whited out gzip\n");
    }
 }

 if (ip.proto == TCP && tcp.dst == 80) {
    if (search(DATA.data, "deflate")) {
       replace("deflate", "       "); 
       msg("whited out deflate\n");
    }
 } 

http://ettercap.sourceforge.net/forum/viewtopic.php?t=2833

I would like to rewrite streams based on my own filter program instead of just simple string replacements.

Anyone have an idea of how to do this? Is there anything other than Ettercap that can do live replacement like this, maybe as a plugin to a VPN software or something?

The rewriting should occur at the transport layer (Layer 4) as it does in this example, instead of a lower layer packet-based approach.

Thanks!

© Stack Overflow or respective owner

Related posts about python

Related posts about socket-programming