Is there an easy way (or is it possible at all) to rewrite a TCP packet as it leaves the machine?
For example if I run

telnet binfalse.de 22

it will search for an unused port to leave the machine. In this case it's 46576:

root@srv % lsof -i -P -n | grep telnet
telnet    10150   user    3u  IPv4 1159425      0t0  TCP> (ESTABLISHED)

But now I want to rewrite these packets to let the server think the requests came from port 1337, or somewhat like this. Of course I know that I don't have to expect an answer in my telnet session.

Of course on 1337 another program is listening, so telling telnet to speak through 1337 is no option...

  • 4
    you should use the word packet instead of package
    – This
    Jun 29 '11 at 16:37
  • 4
    If you want to send IP packets that aren't UDP or a well-formed TCP connection, you need to be root (or have the appropriate capability). Then you could send IP packets that happen to be TCP packets with a bogus source port. But that wouldn't work well, because you'd have to reimplement (a large chunk of) the TCP stack, and you wouldn't go far without being able to receive the ACKs from the other party, which would go to the listening program. Thus you need to re-route the packets to a different port as they come in, with iptables. Jun 29 '11 at 22:21
  • Ok, really don't want to establish a connection, I'd be happy if one single packet leaves my machine, and all nodes that have a look into the packet think that it came from :1337... I don't care for any answer...
    – binfalse
    Jun 30 '11 at 9:09
  • 2
    if that is the case, you should be using a packet-generator like scapy
    – This
    Jun 30 '11 at 15:23

Assuming you are speaking about Linux, iptables has a mangle table that can do all sorts of crazy things to outgoing TCP traffic. iptables NAT features might help as well, because it really sounds like you want to do "port address translation" or "manual NAT."


If you're really using the telnet protocol (or raw tcp streams), you can use nc -p <source_port>... -t negotiates telnet options. I have a terminal server below that accepts telnet connections on tcp/2015 and I will source from tcp/31415

# Window 1
[mpenning@hotcoffee ~]$ nc -p 31415 -t 2015


To verify...

[mpenning@hotcoffee tshark_wd]$ netstat -an | grep 31415
tcp        0      0     ESTABLISHED
[mpenning@hotcoffee tshark_wd]$

This assumes you do not already have a local socket listening on tcp/31415... if you already have a local tcp socket bound on the desired port, iptables is your only option.

  • Unfortunately there is another program listening on this port. so nc -p is no option. But nevertheless it can't be bad to list it here, thx ;-)
    – binfalse
    Jun 29 '11 at 17:47
  • @binfalse, help me understand... do you want an established TCP connection, or just to fake some packets from a certain source port (even if another program is listening on that same port)?
    – This
    Jun 29 '11 at 17:58
  • I have a tool listening at port X. I want to send some packets (e.g. with telnet or netcat or whatever) from the same machine to a server, but want that server to answer to port X. But since there is already something bound to port X your command nc -p X [...] doesn't work.
    – binfalse
    Jun 29 '11 at 19:49
  • I understand why nc won't work... I'm trying to figure out why aren't you just using a packet generator like scapy
    – This
    Jun 29 '11 at 20:03
  • Hey thanks a lot, scapy works just fine. Never heard of something like that!
    – binfalse
    Jul 5 '11 at 14:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.