Subject: Re: Distributed denial of service attacks.
To: Andrew Brown <atatat@atatdot.net>
From: Simon J. Gerraty <sjg@crufty.net>
List: tech-security
Date: 09/09/2001 23:02:29
>>> this is a good suggestion, but leads me to ask: how does one typically
>>> "fling an arbitrarily formed packet" at host x?
>>
>>ipsend, iptest, etc., all part of IP Filter....  (maybe not compiled and
>>installed by default in the integrated version)

>on the flip side, that's good, but not quite enough.  i can't specify
>tcp data (or arbitrary ip packet data) on the command line.  the thing
>i threw together three years ago would allow me to do, eg,

I have a couple of tools - mkpkt and rawpkt which I've used for various
purposes over the years.  Eg. testing fragment reassembly behaviour,
RST'ing hung TCP sessions on MVS systems, generating routing storms 
(in a lab!).  Essentially you can feed arbitrary hex data in to rawpkt
to send out on the wire as a packet (it will normally fix various ip hdr 
fields but can be told not to).  mkpkt just produces the hex data for feeding 
into rawpkt.  Its is also very handy being able to capture packets with
tcpdump and replay them later - against a different target even.

I never made them available - figured they might be missused.
I thought I'd heard that netcat? can do much the same?

--sjg