blog.6admin.io
guest@6admin.io:~$
nemesis, network, security

Nemesis: network packet forge

If you have read the raw sockets article , you know how to forge a SYN by hand in C: fill the fields, compute the checksum, send. It is educational and it is also what Nemesis does from the command line in one invocation. Nemesis is a generic packet forge: TCP, UDP, ICMP, RIP, OSPF, ARP, DNS. Each protocol has its subcommand, each header field has its option.

The idea

A packet forge is the inverse of tcpdump: tcpdump reads what passes, Nemesis builds what passes. The combination of both is the complete network testing protocol: Nemesis forges, tcpdump verifies what actually arrives and you know what your firewall, your switch or your IDS understands from what you sent.

The examples that matter

# A TCP SYN from an arbitrary source IP (spoofed)
nemesis tcp -S 10.0.0.99 -D 192.168.1.100 -y 80 -x 12345 -fS

# An ICMP echo request type 8, code 0
nemesis icmp -S 192.168.1.100 -D 10.0.0.1 -i 8

# A UDP packet to the DNS port
nemesis udp -S 192.168.1.100 -D 10.0.0.1 -x 53 -P payload.txt

# A gratuitous ARP (MAC address announcement)
nemesis arp -S 192.168.1.100 -D 192.168.1.1 -a -d

Each subcommand exposes the protocol header fields as options (-x source port, -y destination port, -fS SYN flag, etc.) and the -P option injects a payload from a file. The result is a packet exactly conforming to what you asked, not to what your kernel would have decided to send.

What it is for in practice

  • Testing a firewall: a SYN spoofed from an IP that should not be allowed and we see whether the firewall filters the source IP or the destination port.
  • Testing an IDS: a packet that matches a known signature, sent by hand and we see whether the alert fires.
  • Pushing a payload through a filtering network: the firewall blocks TCP port 80? A UDP packet to port 53 with a custom DNS payload and you test the real filtering policy.

Nemesis does not replace tcpdump and does not replace raw sockets in C: it fills the gap between them. When you know what you want to send but not yet how to write it in C, Nemesis is the prototyping tool. When you know what you want to read but not yet what arrives, tcpdump is the confirmation tool.