Packet Crafting: Testing Firewall Rules and TCP Behaviour Directly

Packet crafting means building network packets field by field rather than letting the operating system do it. Ordinary tools give you whatever the stack decides to send; a crafting tool lets you set any flag, any port, any sequence number, and any source address. That control is what makes it useful for testing and what makes it dangerous.

Why it beats ping and telnet for testing

The common question in troubleshooting is whether traffic of a particular shape can traverse a path. Ping answers that for ICMP echo only, and a telnet connection attempt answers it for one TCP port with a full handshake.

Crafting answers it precisely. You can send a TCP SYN to port 443 and see whether a SYN-ACK, a RST, or nothing comes back — distinguishing a closed port from a filtered one, which ping cannot do. You can send UDP to a specific port, set the don't-fragment bit at increasing sizes to find the real path MTU, or set particular flag combinations to learn what a firewall passes.

Firewall rule validation is the strongest use. After writing a rule set, generating traffic that should be blocked and confirming it is blocked is the only way to know the rule works as intended. Testing only the allowed paths verifies half the policy.

What the responses tell you

The inference rules are the same ones underneath every scanner. A SYN-ACK means the port is open. A RST means closed. Silence means filtered, or a host that is not there.

ICMP responses carry more detail than people use. Destination unreachable with an administratively-prohibited code means a firewall refused explicitly rather than dropping silently, which tells you a rule exists rather than that nothing is listening. Fragmentation-needed messages reveal the MTU of a link in the path, and their absence — because someone blocked ICMP entirely — is the cause of the classic black-hole problem where small packets work and large transfers hang.

Unusual flag combinations produce the behaviours described under XMAS, FIN and NULL scans, which is really an application of packet crafting rather than a separate technique.

Source spoofing and why it matters

A crafting tool can set any source address. Replies then go to that address rather than to the sender, which has two consequences.

For testing, it lets you verify that anti-spoofing filters work — sending a packet with an internal source address from outside should be dropped at the perimeter, and confirming that is a worthwhile check.

For attackers, it is the mechanism behind reflection and amplification. Send a small request to a service with a spoofed source of the victim's address, and the service sends a much larger response to the victim. Scale that across thousands of reflectors and you have the attacks described under distributed reflected denial of service, with the amplification factor doing the work — the reason services such as NTP were hardened and why open resolvers are treated as a problem.

The defence is ingress and egress filtering: networks should not accept inbound packets claiming internal sources, and should not emit outbound packets whose source is not theirs. That second half is the one operators neglect, and it is what would make spoofing impractical if it were universal.

Using it responsibly

Crafted traffic can cause outages. Flooding with SYN packets exhausts connection tables, malformed packets crash fragile embedded devices, and high rates saturate links. Industrial equipment, medical devices, and older network appliances are all documented casualties.

So: written authorization, agreed windows, rate limits, and exclusion of fragile systems. Spoofing source addresses is particularly worth treating with care, since traffic that appears to come from a third party may be reported as an attack by that third party.

Detecting it

Crafted packets frequently violate expectations in ways that are easy to alert on: flag combinations that cannot occur legitimately, TCP packets with no matching session, sequence numbers out of range, and IP options rarely seen in normal traffic.

Anti-spoofing filters at the network edge both prevent and detect — a dropped packet claiming an internal source from an external interface is a reportable event. Feed firewall denies into your SIEM and alert on the pattern rather than individual packets, since a single odd packet is noise and a sustained stream is not.

Exam angles

Know packet crafting as constructing packets with arbitrary field values, used for firewall rule validation, path MTU discovery, and protocol testing. Understand SYN-ACK, RST and silence as the port state inferences, and ICMP administratively-prohibited as evidence of an explicit firewall rule. Recognize source address spoofing as the basis of reflection and amplification attacks, with ingress and egress filtering as the countermeasure.