mjhjmtu

I've used iptables to reroute traffic to netsed like this, but it seems to route the traffic to another location.

I've used hexinject like this:

hexinject -s -i eth0 -c 1 -f 'arp' | replace '06 04 00 01' '06 04 00 02' | hexinject -p -i eth0

but the problem with hexinject is that it only injects, it doesn't replace the original packet, it just sends another one.

I've also used ettercap + etterfilter, but it doesn't seem to replace the traffic:

if (ip.proto == UDP) 
 if (search(DATA.data, "x1fx0fx00x08x00x01")) 
 log(DATA.data, "/tmp/payload");
 drop();
 execinject("/bin/sed s/x1fx0fx00x08x00x01/x1fx0fx00x08x00x00/g' /tmp/payload");
 msg("caught!"); 
 

What I want to do is replace the hex representation of 1f 0f 00 08 00 01 to 1f 0f 00 08 00 00, just changing the last bit to zero, but I was unable to get iptables + netsed, hexinject, or ettercap + etterfilter to work.

Here's a visualization:

Server attempts to send 1f 0f 00 08 00 01 to someone, a program changes so that 1f 0f 00 08 00 00 is sent instead.

What can I try next? Or maybe I'm using these programs in the wrong way.

You can use HexInject and just add a firewall rule to block the forwarding of that specific packet.

Easy and simple.

An example using IPTables to block UDP packets to port 53:

iptables -A FORWARD -p udp --destination-port 53 -j DROP

If you instead want to filter at layer2, you can give a look at EBTables.

It is a sort of firewall for layer 2 frames.