1DNET(8)                   BSD System Manager's Manual                  DNET(8)
2

NAME

4     dnet — dumb networking library test program
5

SYNOPSIS

7     dnet command args [...]
8

DESCRIPTION

10     dnet is a simple test program for the dnet(3) library. It can be used to
11     compose and transmit network datagrams as a Unix-style filter (e.g. read‐
12     ing from or writing to files and pipes) or modify the local system net‐
13     work configuration (including the ARP cache, firewall ruleset, network
14     interfaces, and routing table).
15
16   Payload generation commands
17     addr address [...]
18          Convert the address (specified as a hostname, IP address, or MAC ad‐
19          dress) into its binary representation on standard output.
20
21     hex string [...]
22          Convert the C-style escaped string (shellcode, for instance) into
23          its binary representation on standard output.
24
25     rand len
26          Write len random bytes to standard output.
27
28   Packet encapsulation commands
29     eth [type type] [src mac] [dst mac]
30          Prepend the data read from standard input with an Ethernet header on
31          standard output. The Ethernet type may be specified as ‘arp’, ‘ip’,
32          or as a hex, octal, or decimal number.
33
34     arp [op op] [sha mac] [spa host] [tha mac] [tpa host]
35          Prepend the data read from standard input with an ARP header on
36          standard output. The ARP op may be specified as ‘req’, ‘rep’,
37          ‘revreq’, ‘revrep’, or as a hex, octal, or decimal number.
38
39     ip [tos num] [id num] [off offset] [ttl num] [proto protocol] [src host]
40          [dst dst]
41          Prepend the data read from standard input with an IP header on stan‐
42          dard output. The fragmentation offset may be specified as a decimal
43          number (optionally concatenated with ‘+’ to indicate more fragments)
44          or as a hex number. The protocol may be specified by name, or as a
45          hex, octal, or decimal number.
46
47     icmp [type num] [code num]
48          Prepend the data read from standard input with an ICMP header on
49          standard output.
50
51     tcp [sport port] [dport port] [flags flags] [seq num] [ack num] [win num]
52          [urp num]
53          Prepend the data read from standard input with a TCP header on stan‐
54          dard output. A port may be specified by name or hex, octal, or deci‐
55          mal number. The TCP flags may be specified as some combination of
56          the characters in the set ‘SAFRPU’ or as a hex number.
57
58     udp [sport port] [dport port]
59          Prepend the data read from standard input with a UDP header on stan‐
60          dard output. A port may be specified by name or hex, octal, or deci‐
61          mal number.
62
63   Packet transmission commands
64     send [device]
65          Read a packet from standard input and send it over the network. If
66          no device is specified, the packet is assumed to be an IP datagram
67          and routed to its destination. Otherwise, the packet is assumed to
68          be an Ethernet frame and is transmitted on the specified interface.
69
70   Kernel interface commands
71     arp show
72          Display the kernel ARP cache.
73
74     arp get host
75          Display the kernel ARP entry for host.
76
77     arp add host mac
78          Add an ARP entry mapping the mac address for host.
79
80     arp delete host
81          Delete the ARP entry for host.
82
83     fw show
84          Display the kernel firewall ruleset.
85
86     fw add|delete action direction device protocol src[:port[-max]]
87          dst[:port[-max]] [type[/code]]
88          Add a rule to or delete a rule from the active firewall ruleset. The
89          action must be either ‘allow’ or ‘block’.  The direction must be ei‐
90          ther ‘in’ or ‘out’.  The device may specify an interface name, or
91          ‘any’.  The protocol may be specified by name, or as a decimal num‐
92          ber. For TCP and UDP protocols, a port (or range, if specified with
93          a max value) may be specified in decimal and appended to the source
94          and/or destination address. For ICMP, a type (and optional code) may
95          be specified in decimal.
96
97     intf show
98          Display the configuration of all network interfaces.
99
100     intf get device
101          Display the configuration for the interface specified by device.
102
103     intf set device [alias host] [dst host] [inet host] [link mac] [up|down]
104          [arp|noarp]
105          Configure the interface specified by device.
106
107     route show
108          Display the kernel routing table.
109
110     route get dst
111          Display the route for the destination dst, specified as a hostname,
112          IP address, or network prefix in CIDR notation.
113
114     route add dst gw
115          Add a route for the destination dst through the gateway gw.
116
117     route delete dst
118          Delete the route for the destination dst.
119

EXAMPLES

121     Send a UDP datagram containing random shellcode:
122
123           dnet hex "\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89" \
124           "\x46\x0c\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80" \
125           "\x31\xdb\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/bin/sh" | \
126           dnet udp sport 555 dport 666 | \
127           dnet ip proto udp src 1.2.3.4 dst 5.6.7.8 | dnet send
128
129     Save an ARP request in a file and send it twice:
130
131           dnet arp op req sha 0:d:e:a:d:0 spa 10.0.0.3 tpa 10.0.0.4 | \
132           dnet eth type arp src 0:d:e:a:d:0 dst ff:ff:ff:ff:ff:ff > arp.pkt
133           dnet send fxp0 < arp.pkt
134           dnet send fxp0 < arp.pkt
135
136     Send a fragmented ping packet:
137
138           # Create ping packet with IP header, to set ICMP checksum
139           echo "monkey monkey monkey monkey" | dnet icmp type 8 code 0 | \
140           dnet ip proto icmp src 1.2.3.4 dst 5.6.7.8 > ping.pkt
141
142           # Chop off IP header
143           dd if=ping.pkt of=ping.data bs=20 skip=1
144
145           # Fragment IP payload
146           split -b 24 ping.data p.
147
148           # Send fragments
149           dnet ip id 1 off 0+ proto icmp src 1.2.3.4 dst 5.6.7.8 < p.aa | \
150           dnet send
151           dnet ip id 1 off 24 proto icmp src 1.2.3.4 dst 5.6.7.8 < p.ab | \
152           dnet send
153

SEE ALSO

155     dnet(3)
156

AUTHORS

158     Dug Song ⟨dugsong@monkey.org⟩
159
160BSD                            October 17, 2001                            BSD
Impressum