https://netacoding.com/tags/packet-crafting/ Recent content in Packet-Crafting on Netacoding | Cybersecurity, Assembly & Network Research https://netacoding.com/img/logo-netacoding.png https://netacoding.com/img/logo-netacoding.png Hugo en-us Fri, 27 Mar 2026 11:25:05 +0300 https://netacoding.com/posts/rfc-1071/ Fri, 27 Mar 2026 11:25:05 +0300 https://netacoding.com/posts/rfc-1071/ RFC 1071 checksum computes a 16-bit one's complement sum over the entire packet in 2-byte chunks. x64 Assembly implementation: word-by-word accumulation loop, odd-byte final block, carry folding via shr/and/add/adc, not ax inversion for final checksum. Required for ICMP packets to pass kernel validation — malformed checksum causes silent drop before delivery. https://netacoding.com/posts/network-fingerprinting/ Fri, 27 Mar 2026 00:00:00 +0000 https://netacoding.com/posts/network-fingerprinting/ Every OS leaves a unique ICMP fingerprint: Linux sends 64-byte payloads with 8-byte RDTSC timestamps, Windows sends 32-byte alphabetical sequences. Covers OS-specific TTL and payload signatures, DPI evasion via traffic mimicry, and x64 Assembly implementation of NIDS-bypassing ICMP packet structures. https://netacoding.com/posts/icmp_encapsulation/ Fri, 27 Mar 2026 00:00:00 +0000 https://netacoding.com/posts/icmp_encapsulation/ ICMP Type 3 (Destination Unreachable) mandates reflection of the original IP header plus 8 bytes — a field attackers control entirely. Nested ICMP encapsulates secondary protocol headers inside the mandatory reflection segment, bypassing stateful firewalls that classify Type 3 as benign error traffic. 0xFFFF boundary manipulation causes DPI engines to misidentify packet boundaries and skip payload analysis.