Packet-Crafting

ICMP packets with incorrect checksums are silently dropped by the kernel before reaching the destination. RFC 1071 mandates 16-bit one’s complement sum: accumulate packet words in eax, handle odd trailing byte separately, fold the carry bits (shr r11d,16 → and eax,0xFFFF → add ax,r11w → adc ax,0), invert with not ax. The receiver repeats the same sum — result must be 0xFFFF for a valid packet. Full x64 Assembly implementation with register layout, loop termination, and ICMP header integration.

Linux and Windows ICMP Echo Requests differ in payload size (64B vs 40B), default content (timestamp vs alphabetical), and TTL values — forming OS-specific network fingerprints that NIDS use for traffic classification. Traffic mimicry replicates these signatures at the assembly level: 8-byte RDTSC timestamp emulation, sequential byte padding (0x10–0x1F), and strict 64-byte structural alignment bypass DPI anomaly detection without triggering empty-payload or entropy signatures.

Stateful firewalls and DPI engines classify ICMP Type 3 (Port Unreachable) as error traffic and skip deep inspection. RFC 792 requires the original IP header plus 8 bytes in the reflection field — this is attacker-controlled space. By placing a fully-formed secondary ICMP header inside the reflection segment, arbitrary protocol data traverses perimeter controls unanalyzed. The 0xFFFF boundary anomaly causes packet boundary miscalculation in DPI engines, leaving the nested payload invisible to signature matching. Full x64 Assembly implementation with raw socket crafting.