TRIPP Traffic Rewriter for IP (v4) Packets

TRIPP is a utility to rewrite incoming and outgoing IP packets.
Since it can rewrite both headers and payload, it can be used to configure
the tcp/ip stack behavior in order to perform various tasks mainly intended
for network tests, simulations and development.

It is configured via a small rule-based language, which allows the user to intercept
packets, set arbitrary header values, increment or decrement numeric header fields,
set an arbitrary payload, rewrite parts of the payload, or fragment, delay, multiply,
or drop packets.

It is totally user-level and doesn't require any kernel module.



Sample Applications (see docs for examples):
   [o] test network applications
   [o] test firewalls, IDS ecc..
   [o] passive os fingerprint spoofing
   [o] authenticate connections to OpenBSD pf
   [o] customize packets sent by network scanners
   [o] test/evade (weak) IDS/IPS via ip fragmentation (like fragroute)
   [o] generate network anomalies
   [o] inject a custom bytestream into active connections and potentially trigger software bugs
   [o] forward packets between hosts
   [o] maybe many other little things... (ie quickly rewrite session cookies)

WARNING: the packet delayer doesn't work correctly: due to the usleep() resolution in
multithreaded apps the packets can be delayed for a time NOT LESS than 10ms! This is
true for Linux and OpenBSD, on Darwin (MacOSX) the delayer will work correctly.
On Linux and OpenBSD it's possible to use the packet delayer with a resolution of
10ms, i.e a rule like OUT(tcp)delay(1) will delay all outgoing tcp packets by 10ms
OUT(tcp)delay(50) will delay pkts by 500 ms and so on..
I'm working on fixing it..


Download:
   tripp-beta1 for linux or BSD only (added:09-25-2006)
   Changelog


Documentation:
   documentation (added:02-24-2005, last update:09-25-2006)


Dependences:
      libpcap

You can also take a look at older versions

Report bugs, ecc to poplix papuasia org - http://px.dynalias.org
To keep updated with this tool please subscribe at freshmeat page

Known Bugs and Limitations:
   Please note that tripp is an a very embrional state: ip options are
   not processed, not all tcp options are supported, icmp support is broken,
   tripp works on ethernet only.