Free packet loss software for linux

WANem is a WAN Emulator, meant to provide real experience of Internet, during development and test on a LAN environment. Typically application developers develop applications on a LAN while the intended purpose for the same could be the client is accessing the application by WAN or even the internet.

WANem allows for the application development team to setup a transparent application gateway which can be made use to simulate WAN characteristics like Network delay, Packet loss, Packet corruption, Disconnections, Packet re-ordering, Jitter, etc.

WANem allows for WAN network characteristic emulation and thus allowing for applications to be tested in a realistic WAN environment before they are moved into production.

WANem is a combined development strategy where it hooks into the Linux kernel for performing network emulations and provides GUI to make it simple to use. Remastering of Knoppix Live CD makes it even more effective as it becomes platform independant.

Layer-7 Packet Classifier for Linux is a packet classifier for Netfilter that identifies packets based on application layer (OSI layer 7) data. This means that it is able to classify packets as HTTP, FTP, Gnucleus, Kazaa, etc., regardless of ports.
It complements existing matches that classify based on port numbers, packet length, TOS bits, and so on. Combined with Linux QoS, it allows for full layer 7 packet shaping.
Main features:
- Patches for Linux 2.4 and 2.6
- Support for TCP, UDP and ICMP over IPv4
- Uses Netfilters connection tracking of FTP, IRC, etc
- Examines data across multiple packets
- Number of packets examined tunable on the fly through /proc
- Number of bytes examined tunable at module load time
- Distinguishes between new connections (those still being tested) and old unidentified connections
- Gives access to both Netfilter and QoS (rate limiting) features
- With the Netfilter "helper" match, you can distinguish between parent and child connections (e.g. ftp command/data)

tcpdump is a handy little library which provides a packet filtering mechanism based on the BSD packet filter (BPF).

Most notably, tcpdump needs this to work, and there is also a perl module (still in beta) which can use this as well. In plain english, if you want to write your own network traffic analyzer, this is the place to start.

mrtg-ping-probe project monitors round trip time and packet loss to another host. Still on my TODO list: add own min/max/avg rtt calculation, add perl ping module, add rping and rsh support...
mrtg-ping-probe is a ping probe for MRTG 2.x. It is used to monitor the round trip time and packet loss to networked devices. MRTG uses its output to generate graphs visualizing minimum and maximum round trip times or packet loss.
mrtg-ping-probe depends on the following software being installed on your system: perl (at least version 5.6.1), mrtg (I use version 2.8.8, though any mrtg 2.x version should work), and a ping program that displays a summary of the round trip times upon termination or timeout.
mrtg-ping-probe runs on AIX, BSD/OS 2.1, FreeBSD/2.2.x, IRIX/6.2, Linux, Mac OS X (Darwin 5.4), NetBSD, OpenBSD, OS/2, OSF1 V3.2, Solaris 1.1.2 (SunOS 4.1.4), Solaris 2.5.1 (SunOS 5.5.1), Solaris 7 (SunOS 5.7), Solaris 8 (SunOS 5.8), Solaris 9 (SunOS 5.9), HP-UX 9, Windows 98, and Windows 2000 (english, french, portugesee, and spanish locales).
If you install the Windows ping program that comes with Windows 98, Windows 2000, or WinSock 2.x, mrtg-ping-probe will also run on Windows 95 and Windows 4.0.
Support for additional systems is usually easy to add, as described in the file INSTALL.
Act responsible: do not use mrtg-ping-probe to ping devices without the owners permission. Just imagine 10,000 people would decide to ping your hosts ... mrtg-ping-probe is meant to be used within your network to get round trip time performance figures for your network.
Usage: mrtg-ping-probe [-hsvV] [-d deadtime] [-k count] [-l length] [-o ping_options] [-p [factor*]{min|max|avg|loss|integer}/[factor*]{min|max|avg|loss|integer}] [-r [rsh:][user@]host[:osname]] [-t timeout] host
Enhancements:
- new platforms supported: italian Windows 2000 locale.
- bugfixes: on Windows actually return deadtime when we lost all packets, not 0. the ping child process should actually be killed now on Unix platforms.
- changes: ***** Possible Incompatability ***** raised minimum required perl version to 5.6.1. lots of typos fixed.

iptables and netfilter are building blocks of a framework inside the Linux 2.4.x and 2.6.x kernel. This framework enables packet filtering, network addresss [and port] translation (NA[P]T) and other packet mangling. It is the re-designed and heavily improved successor of the previous Linux 2.2.x ipchains and Linux 2.0.x ipfwadm systems.
iptables is a generic table structure for the definition of rulesets. Each rule within an IP table consists out of a number of classifiers (iptables matches) and one connected action (iptables target).
netfilter, iptables and the connection tracking as well as the NAT subsystem together build the whole framework.
Main features:
- stateless packet filtering (IPv4 and IPv6)
- stateful packet filtering (IPv4)
- all kinds of network address and port translation (NAT/NAPT)
- flexible and extensible infrastructure
- multiple layers of APIs for 3rd party extensions
- large number of plugins/modules kept in patch-o-matic repository

The hosts can be configured to run arbitrary services, and their personality can be adapted so that they appear to be running certain operating systems. Honeyd enables a single host to claim multiple addresses - I have tested up to 65536 - on a LAN for network simulation.

Honeyd improves cyber security by providing mechanisms for threat detection and assessment. It also deters adversaries by hiding real systems in the middle of virtual systems.
It is possible to ping the virtual machines, or to traceroute them. Any type of service on the virtual machine can be simulated according to a simple configuration file. Instead of simulating a service, it is also possible to proxy it to another machine.

annotate "AIX 4.0 - 4.2" fragment old
# Example of a simple host template and its binding create template
set template personality "AIX 4.0 - 4.2"
add template tcp port 80 "sh scripts/web.sh"
add template tcp port 22 "sh scripts/test.sh $ipsrc $dport"
add template tcp port 23 proxy 10.23.1.2:23
set template default tcp action reset

bind 10.21.19.102 template

The different TCP personalities are learned from reading a nmap fingerprint file. The configured personality is the operating system that nmap or xprobe will return. Personalities can be annotated to determine if they allow FIN-scans for open ports or to select the preference in which they reassemble fragmented IP packets.

Honeyd can be used to create a virtual honey net or for general network monitoring. It supports the creation of a virtual network topology including dedicated routes and routers. The routes can be attributed with latency and packet loss to make the topology seem more realistic.
Because Honeyd interacts with potentially malicious adversaries, you should sandbox it with Systrace. Systrace prevents an adversary from exploiting bugs in your Honeyd scripts.

Subsystem Virtualization

Honeyd supports service virtualization by executing Unix applications as subsystems running in the virtual IP address space of a configured honeypot. This allows any network application to dynamically bind ports, create TCP and UDP connections using a virtual IP address.
Subsystems are virtualized by intercepting their network requests and redirecting them to Honeyd. Every configuration template may contain subsystems that are started as separated processes when the template is bound to a virtual IP address. An additional benefit of this approach is the ability of honeypots to create sporadic background traffic like requesting web pages and reading email, etc.

Network Simulation/Internet-In-The-Box

Honeyd supports assymetric routes and the integration of physical machines into the virtual network topology. As a result, it is possible to use Honeyd for simple network simulations: Physical hosts can be exposed to high latency or packet loss, arbitrary routing infrastructures, etc.

route entry 10.0.0.1 network 10.0.0.0/8
route 10.0.0.1 link 10.0.0.0/24
route 10.0.0.1 add net 10.4.0.0/14 tunnel "thishost" "honeyd-b"
route 10.0.0.1 add net 10.1.0.0/16 10.1.0.1 latency 55ms loss 0.1
route 10.0.0.1 add net 10.2.0.0/16 10.2.0.1 latency 20ms loss 0.1
route 10.0.0.1 add net 10.3.0.0/16 10.2.0.1 latency 20ms loss 0.1
route 10.1.0.1 link 10.1.0.0/24
route 10.2.0.1 link 10.2.0.0/24
[...]
route 10.2.0.1 add net 10.3.0.0/16 10.3.0.1 latency 10ms loss 0.1
route 10.3.0.1 link 10.3.0.0/24
route 10.3.0.1 add net 10.3.1.1/24 10.3.1.1 latency 10ms
route 10.3.0.1 add net 10.3.240.0/20 10.3.240.1 latency 5ms
route 10.3.1.1 link 10.3.1.1/24
route 10.3.240.1 link 10.3.240.0/20
route 10.3.240.1 add net 0.0.0.0/0 10.3.0.1 latency 40ms loss 0.5
[...]
bind 10.2.0.243 to fxp0
bind 10.3.1.15 to fxp0

Using GRE tunneling allows the creation of distributed setups that allow Honeyd to scale to larger networks. It also allows virtual machines to be spread across separate address spaces as GRE tunnel selection can be based on the source addresses.