Download
A simple packet crafting tool that turns text commands into pcaps. Optionally build a DAQ and Snort can directly read commands or raw payload data - no pcap required. Packets can exhibit any flaw or anomaly desired. Syntax is flexible and powerful.
Features
- Simple, Extensible
- IP4 and IP6
- Useful for testing IDS / IPS, etc.
- Create good and evil packets
- Total control of packet contents
- Includes optional Snort DAQ
- Abcip depends on libpcap only
- Input abc commands or raw payload
- Automatically segment TCP streams
- Automatically fragment IP4 and IP6 packets
- Randomize or reverse packet sequences
- Automatically create valid bidirectional TCP sessions
- Supports multiple concurrent sessions
Categories
InternetLicense
GNU General Public License version 3.0 (GPLv3)Follow abcip
Other Useful Business Software
Level Up Your Cyber Defense with External Threat Management
Move beyond alerts. Gain full visibility, context, and control over your external attack surface to stay ahead of every threat.
Rate This Project
Login To Rate This Project
User Reviews
-
ABCIP is awesome. I use it to test Snort and other network analysis utilities off-the-wire. What is ABCIP really though? ABCIP interprets a text-based specification which it then converts into a PCAP. All supported protocols (which is a growing set), fields can be modified easily per-packet, or per-session. Automatic IPv4/IPv6 fragmentation, TCP Segmentation, and TCP Sequence + Acknowledgment calculation are easily its most undervalued features. To give the project homescreen some substance, I've taken the liberty to annotate one of the tests included in the package. --- # Run the following, ABCIP default reads from STDIN $ abcip --pcap http.pcap # Define the packet layers d ( stack="eth:ip4:tcp" ) # Configure the layers (index of layers starts at 2) # 3:a == layer 3 (IPv4) client address # 4:b == layer 4 (TCP) server address; i.e., "port". # # If the layer referencing confuses you, refer to the OSI Model. c ( 3:a="192.168.1.101", 4:b=80 ) a ( syn ) b ( syn, ack ) a ( ack ) # HTTP Client GET request a ( psh,ack,data="GET / HTTP/1.1|0D 0A 0D 0A|" ) # HTTP Server Response b ( psh,ack,data= "HTTP/1.1 200 OK|d a|" "Transfer-Encoding: chunked|d a|" "Content-Type: text/html; charset=iso-8859-1|d a d a|" ) # HTTP Server Response-Continued b ( psh,ack,data="A|d a|ABCDEFGHIJ|d a|" ) b ( psh,ack,data="4|d a|EFGH|d a|" ) # Client acknowledges the reciept of the three(3) prior "b()" statements a ( ack ) # HTTP Server Response-Continued again b ( ack, data="4|d a|IJKL|d a|" ) b ( ack, data="4|d a|MNOP|d a d a|" ) # Client acknowledges the reciept of the two(2) prior "b()" statements a ( ack ) # TCP 4-way FIN Shake (3 packet short-form). b ( fin, ack ) a ( fin, ack ) b ( ack ) ---- ABCIP fanboy for 4 years; since before it existed on Sourceforge.