Build and inspect network packets
Construct raw network packets for testing, debugging, and protocol development. Understand Ethernet, IP, and transport layer encapsulation.
- 1
A network packet is built by encapsulation: application data → transport header (TCP/UDP) → IP header → Ethernet header. Each layer adds its header. The Ethernet header (14 bytes) contains destination MAC, source MAC, and EtherType (0x0800 for IPv4, 0x86DD for IPv6).
- 2 Hex Encoder →
Encode the packet fields as hex. Build the Ethernet header (dst MAC + src MAC + EtherType), then IP header (version, IHL, TTL, protocol, IPs), then transport header (ports, seq, flags). Concatenate the layers to form the raw packet.
- 3 Binary Encoder →
Encode specific fields in binary for bit-level control. The IP flags (Reserved, DF, MF) are 3 bits. The TCP flags (FIN, SYN, RST, PSH, ACK, URG) are 6 bits. Binary encoding gives precise control over individual flags.
Frequently asked questions
- What is encapsulation?
- Each layer wraps the layer above it. The application data is wrapped in a TCP segment (TCP header + data), which is wrapped in an IP packet (IP header + TCP segment), which is wrapped in an Ethernet frame (Ethernet header + IP packet + FCS). Each layer is independent.
- Why build raw packets?
- For network testing (verify protocol implementations), security research (craft specific flag combinations), debugging (reproduce issues with specific packet patterns), and learning (understand protocols at the byte level). Tools like Scapy (Python) and hping3 are used for this.
Workflows that solve this
Learn more
Want to understand why?