Network Security Tools

Getting Started with libnet

When using libnet it is important to remember that packets are encapsulated at a lower level by yet another type of packet, as illustrated in Figure 11-2. This is important because libnet requires that each encapsulating packet is created, in order, from the highest-level protocol to the lowest-level protocol.

Figure 11-2. Protocol encapsulation example

Although the libnet library provides you with granular access to network packet creation at each level of the protocol stack, sometimes you don’t need total control over the packet-creation process. libnet handles such instances in two ways: it creates packets at one of the LIBNET_RAW injection types, and it uses the libnet_autobuild_*( ) functions supplied for common protocols.

libnet supports two types of packet injection: injection at the link layer (LIBNET_LINK, etc.), and injection at the Internet layer (LIBNET_RAW4, etc.). The complete list of supported injection types is provided in Table 11-1. If you require total control over the link layer network packet, you have little choice but to use a link layer injection type. However, if the tool will be creating packets at the Internet layer (or higher), you can use the Internet layer injection type. This injection type leverages the operating system to actually send the packet, and as such, you don’t have to worry about correctly framing the Ethernet packet ...