I am interested in starting to decode and understand some proprietary network traffic, sent from apps on various devices, such as my TV, game consoles, phones etc.

Most of the things I want to look at, seems to be using UDP to send proprietary protocol traffic.

I've spent some time in Wireshark analyzing traffic, and now the next stage is to attempt modifying messages and looking at results. This is where I have run into trouble.

I attempted to use my Windows laptop as a MitM, bridging my 2 Ethernet connections (one to device and one to router). However, it seemed I was completely unable to spoof traffic from the device. Since UDP is very spoof able, I was not sure what is going wrong.

What is the best way to do this, and is there a framework/toolkit in place to help facilitate this type of research?

  • could you please add details regarding this network structure: connections, what's wifi and what is ethernet, firewalls and such? this will help understand the problem. In addition there usually isn't a generic solution for this type of thing, since the proprietary protocol might include defences which you need to overcome (like signing the mac address for example). It would help if you add information regarding your specific protocol. – Eli K Feb 11 '17 at 18:07

As shown here you can use Scapy to capture and/or spoof packets, while you are doing that make sure you compute checksums right. You can use Wireshark to check headers. Most convenient way is capturing incoming traffic and changing data & checksum value.

  • While attempting to mitm packets between device and internet, my router seemed to be rejecting spoofed udp packets. Does scapy help facilitate the spoofing aspect? Can you "pause" traffic, change packets and then release it, similar to tamperdata for firefox? – Ryan Feb 10 '17 at 19:42
  • Is your problem about duplicate packets like here? – Kerim Can Kalıpcıoğlu Feb 10 '17 at 19:51
  • No, definitely not an issue with duplicate packets. I have two different internet connections, so I can test devices talking to each other over the internet and attempt to intercept. The 'target' device never sees traffic that I spoof from the source, ports are open, all should be good. I am wondering if it was something to do with UPnP. – Ryan Feb 10 '17 at 20:11
  • Maybe your packets drop before leaving your device, because of ethernet stack or something? Can you check with Wireshark? – Kerim Can Kalıpcıoğlu Feb 10 '17 at 22:33
  • @de61 I am using an ISP supplied router otherwise I would love to have it on the router to check. I see it going out on my mitm laptop with wireshark, but it never seems to reach the router and certainly not the target – Ryan Feb 11 '17 at 2:12

You can modify packets with scapy ,create custom python code using scapy module to send custom packet.

  • 1
    Is that a framework in place that can intercept and replace packets? When spoofing from the laptop, the router did not seem to accept the spoofed packets as coming from the device, not sure how to fix that? – Ryan Feb 10 '17 at 14:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.