Network Packet Inspector in Mac OSX
-
20-09-2019 - |
Question
I'm trying to create a network packet inspector.
I know you can do this with libpcap, but it's not a sniffer, i need to forge network packet, before it was sent on network. (sending via socks server)
I found 2 ways to do this :
- Using an NKE. (Network Kernel Extension)
- Using a DYLD_INSERT_LIBRARIES to insert a library to hook network function.
Which method do you think is the best ?
Solution
Neither, use a tun/tap device: http://tuntaposx.sourceforge.net/
You'll need to route the traffic to that device, modify it, then send it back. You can do this with firewall rules. There are lots of examples of using tun/tap all over the open-source world, it isn't hard.
Advantage: it's a kernel extension, but a standard kernel extension, and therefore you don't need to worry about debugging it.
Licensed under: CC-BY-SA with attribution
Not affiliated with StackOverflow