How do I create a UDP packet?

Question

When I perform the following Netcat command and view the packets with Wireshark, it says the UDP packet is malformed.

$ echo "this is a test" | nc -u 127.0.0.1 53

Similarly, using commands like $ echo "this is a test" > /dev/udp/127.0.0.1/53 produce "malformed packet" errors in Wireshark.

The echo command gets sent/delivered to the Netcat server without errors. But this got me wondering: is it possible to manually construct a proper UDP packet with echo or some other native Unix tool(s)?

I'm using Debian and macOS.

Answer 1

Your packet is completely valid, from the viewpoint of IP and UDP. If you expand the protocol details for Ethernet/IP/UDP in the lower pane of Wireshark, you will see that the packet is successfully parsed.

However, as it is destined for port 53, Wireshark attempts to parse it as a DNS packet, which it cannot do (since the string "this is a test" is not a valid DNS request per the RFC 1035 spec).

If you follow the specification at that link, you will be able to construct a packet that is valid when parsed as a DNS request. If you send the packet to another port, you'll notice that Wireshark will no longer parse it as a DNS request and will hence not show that warning.

Answer 2

You can send them to Bash special aliases with redirection.

From Bash manpages:

/dev/tcp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, bash attempts to open the corresponding TCP socket.

/dev/udp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, bash attempts to open the corresponding UDP socket.

This will send a UDP packet to 192.168.2.11 to port 8080:

echo "This is a test" > /dev/udp/192.168.2.11/8080

Answer 3

There are multiple questions here; the claim of a "malformed packet" may be due to checksum offloading and if so is a false error as it reflects the packet capture not having a complete view--some of the work was instead done on the network hardware. WireShark should have documentation on this.

Otherwise, various tools (such as socat, nc or netcat, or via extremely similar features in shells such as ksh93 or bash) can take bytes from standard input and dump them into what becomes a UDP packet. Whether this is "proper" depends on the protocol; one could in theory construct and send a DNS or DHCP packet this way, though more often folks use a library or dedicated software that (hopefully) correctly implements the protocol in question, as there is usually a lot more involved than setting a few bits in the body of a packet and sending that out over the wire, notably handling responses, retrying after timeout or error, packet header fields, etc. The protocols are usually very well documented in RFC, or see the "TCP/IP Illustrated" book series by Stevens for even more documentation.

Specific tools such as nmap do very custom things with packet construction. Otherwise for manual packet construction a programming language is typically used, though again most software will use existing libraries or system services to send out DNS or DHCP or other UDP packets, as those are far less work and far less error prone than manually crafting a raw packet from scratch.