I have a simple problem which I'm sure someone here has done before...

I want to rewrite Layer 4 TCP/IP streams (Not lower layer individual packets or frames.) Ettercap's etterfilter command lets you perform simple live replacements of Layer 4 TCP/IP streams based on fixed strings or regexes. Example ettercap scripting code:

 if (ip.proto == TCP && tcp.dst == 80) {
    if (search(DATA.data, "gzip")) {
       replace("gzip", "    ");
       msg("whited out gzip\n");
    }
 }

 if (ip.proto == TCP && tcp.dst == 80) {
    if (search(DATA.data, "deflate")) {
       replace("deflate", "       "); 
       msg("whited out deflate\n");
    }
 } 

http://ettercap.sourceforge.net/forum/viewtopic.php?t=2833

I would like to rewrite streams based on my own filter program instead of just simple string replacements. Anyone have an idea of how to do this? Is there anything other than Ettercap that can do live replacement like this, maybe as a plugin to a VPN software or something?

I would like to have a configuration similar to ettercap's silent bridged sniffing configuration between two Ethernet interfaces. This way I can silently filter traffic coming from either direction with no NATing problems. Note that my filter is an application that acts as a pipe filter, similar to the design of unix command-line filters:

 >[eth0] <----------> [my filter] <----------> [eth1]<

What I am already aware of, but are not suitable:

• Tun/Tap - Works at the lower packet layer, I need to work with the higher layer streams.

• Ettercap - I can't find any way to do replacements other than the restricted capabilities in the example above.

• Hooking into some VPN software? - I just can't figure out which or exactly how.

• libnetfilter_queue - Works with lower layer packets, not TCP/IP streams.

Again, the rewriting should occur at the transport layer (Layer 4) as it does in this example, instead of a lower layer packet-based approach. Exact code will help immensely!

Thanks!