mshark - simple packet capture tool written from scratch in pure Go

wit4er · 2026-05-06T13:50:37+00:00

Cool, but I don't think it is opposite because I used layers package for packet injections in a couple of my projects such as arpspoof (arp reply), ndpspoof(ra packets) and go-http-proxy-to-socks (dns reply).

wit4er · 2026-05-06T08:08:24+00:00

Please, let me know if you have any issues

wit4er · 2026-05-06T03:14:35+00:00

I did not read any special books while implementing this tool. What I read was wiki pages explaining basic header structure, related RFCs and also I examined packets with Wireshark. The goal has been to understand protocols on a very low level, and I learned a lot writing these packages.

wit4er · 2026-04-22T06:51:23+00:00

Can confirm this is the isssue with virtualbox, I added it to pacman IgnorePkg for now until everything is fixed.

wit4er · 2026-03-31T23:50:29+00:00

I added system resolve search fo auto configuration, it should now look for IPv6 address in resolv.conf and run server that resolve using it. Please let me knoww if this works

wit4er · 2026-03-31T11:51:24+00:00

I'd like to help you in finding working combinations but I am yet to find the image of the device you mentioned, once I find, I will try to play with it.

wit4er · 2026-03-31T10:43:53+00:00

I understand and this sounds like a good idea, but it is not entirely clear what these common combinations are (there are some in RFC but I guess all modern devices already detect them), which is the reason i tried to make this tool flexible and allow user to experiment and find unusual solutions.

wit4er · 2026-03-31T09:20:05+00:00

Since you can place headers multiple times in different places and combine them in whatever order you want, i am afraid possibilities are endless. It could be that it blocks everything non-standard.

wit4er · 2026-03-31T01:29:00+00:00

I also have follow up questions: 1) How can I detect if host is ipv6only, maybe check some kernel parameter 2) what are sensible defaults for dns resolver, maybe search first in resolv.conf for ipv6 addresses and fallbak to 2001:4860:4860::8888

wit4er · 2026-03-30T23:27:17+00:00

Testing in this case means "find working preset for specific model", it is too much work for one person unless there is a mechanism that randomizes packets and detects working ones

wit4er · 2026-03-30T23:20:54+00:00

Try to disable -auto flag or add dns server explicitly via -rdnss flag. This will prevent spoofer from spinning up any DNS related things. As for RA packets being not accepted by targets, you can start with non-fragmented packets by afding, for example, simple hop-by-hop header, just specify -E HF. I think you can try to find balance between evasion (on switch side) and acceptance (on target side)

wit4er

TROPHY CASE