Using Custom Packet Manipulation with Nmap

Using Custom Packet Manipulation with Nmap

Nmap, short for Network Mapper, is one of the most powerful and flexible open-source tools used for network discovery and security auditing. It is widely recognized for its capabilities to perform port scanning, service identification, OS detection, and more. However, many users only scratch the surface of what Nmap can do.

One of Nmap’s lesser-known but incredibly potent features is custom packet manipulation. This allows advanced users to go beyond default scan configurations and craft packets tailored to their needs—whether to bypass firewalls, mimic specific behaviors, or uncover obscure vulnerabilities.

In this article, we’ll delve deep into custom packet manipulation in Nmap, including why and how to use it, with practical examples and key options explained.

Table of Contents

• Using Custom Packet Manipulation with Nmap
  • Table of Contents
  • Why Use Custom Packet Manipulation?
  • Understanding Nmap Scan Types
  • The Role of the Nmap Scripting Engine (NSE)
  • Key Options for Packet Manipulation
    • --data-length <num>
    • --data <hex_string>
    • --ip-options <hex_string>
    • --ttl <value>
    • --source-port <port>
    • --spoof-mac <mac_address|vendor>
    • --badsum
    • -g <port>
  • Examples of Custom Packet Manipulation
    • 1. Evading a Basic Firewall
    • 2. Sending Custom Data Payloads
    • 3. Scanning with MAC Spoofing
    • 4. Crafting Packets with IP Options
  • Bypassing Firewalls and IDS
  • Limitations and Considerations
  • Conclusion

Why Use Custom Packet Manipulation?

In a typical scan, Nmap crafts packets according to the scanning method and OS fingerprinting. But with custom packet manipulation, you can:

• Evade intrusion detection/prevention systems (IDS/IPS).
• Trigger uncommon service responses.
• Emulate specific attack vectors.
• Perform stealth scans that may go unnoticed by security appliances.
• Test firewall rules more precisely by altering TTL, flags, and payloads.

This level of granularity makes it an invaluable feature for penetration testers, red teamers, and network researchers.

Understanding Nmap Scan Types

Before diving into manipulation, it’s crucial to understand the basic scan types Nmap supports. Some of these already provide low-level control over packet attributes:

These scan types already show how Nmap can manipulate TCP flags. But we can go further with options that allow control over additional fields.

The Role of the Nmap Scripting Engine (NSE)

The Nmap Scripting Engine (NSE) allows users to write and run Lua-based scripts to automate tasks during scans or extend Nmap’s functionality.

While NSE isn’t always used for low-level packet crafting, it can be combined with custom packet options to produce targeted effects. NSE scripts can:

• Craft raw packets.
• Modify headers dynamically.
• Interact with services using specific payloads.
• Integrate third-party libraries or logic for behavior-based scanning.

Scripts like http-methods.nse, smb-protocols.nse, and ipidseq.nse demonstrate how deep NSE can go in protocol manipulation.

Key Options for Packet Manipulation

Here are the most useful options for manipulating packet behavior directly in Nmap:

--data-length <num>

Appends random data to the packet payload. Useful to bypass IDS looking for specific packet sizes.

nmap -sS --data-length 50 target.com

--data <hex_string>

Injects specific data (in hex) into the packet payload.

nmap -sS --data 48656c6c6f target.com  # Sends "Hello"

--ip-options <hex_string>

Adds raw IP options to the packet. This is an advanced technique for experimenting with packet behavior.

nmap -sS --ip-options 440204 target.com

--ttl <value>

Sets the Time To Live value for packets, which can be used to map hops or bypass certain firewall settings.

nmap -sS --ttl 133 target.com

--source-port <port>

Spoofs the source port. Some firewalls are configured to allow specific source ports, like 53 (DNS) or 123 (NTP).

nmap -sS --source-port 53 target.com

--spoof-mac <mac_address|vendor>

Spoofs a MAC address to imitate another machine or device type.

nmap -sS --spoof-mac Apple target.com

--badsum

Sends packets with bad checksums to test if the target accepts malformed packets.

nmap -sS --badsum target.com

-g <port>

Alias for --source-port. Often used in evasion.

Examples of Custom Packet Manipulation

Let’s explore a few practical examples of how you can combine options to perform powerful scans.

1. Evading a Basic Firewall

nmap -sS -p 80 --ttl 133 --source-port 53 target.com

This SYN scan:

• Uses TTL 133 (odd enough to slip through some filters).
• Spoofs port 53, often trusted due to DNS traffic.

2. Sending Custom Data Payloads

nmap -sS --data 48656c6c6f2c20746865726521 -p 80 target.com

This scan injects the string “Hello, there!” into the payload, potentially triggering different service behavior.

3. Scanning with MAC Spoofing

nmap -sS --spoof-mac Cisco -p 80,443 target.com

This may trick the target into thinking the probe comes from a legitimate Cisco device.

4. Crafting Packets with IP Options

nmap -sS --ip-options 830400000000 -p 80 target.com

Injects specific IP options—often used for research into stack behaviors or IDS testing.

Bypassing Firewalls and IDS

Many intrusion prevention systems rely on signature-based detection or rule-based logic. Custom packet manipulation lets you subvert these by:

• Altering flags so packets don’t match known scanning signatures.
• Injecting payloads that shift packet size away from expected norms.
• Spoofing source ports or MAC addresses to emulate trusted devices.
• Tweaking TTL to avoid traceroute-like detection systems.
• Using bad checksums to test whether the remote host responds even when normal routers would not forward the packet.

However, this also places ethical and legal responsibilities on the user. Always ensure you have permission to scan and test a network using such techniques.

Limitations and Considerations

While Nmap’s packet manipulation capabilities are powerful, there are a few important caveats:

1. Limited to Nmap’s scope: For extremely custom crafting (e.g., fully manual TCP stream construction), tools like Scapy or hping may be more appropriate.
2. System permissions: Most raw packet operations require root/administrator privileges.
3. Detection risk: Custom scanning can trigger alerts if improperly used—stealth is not always guaranteed.
4. Network behavior: Intermediate devices (NAT, load balancers) may drop or modify your packets, affecting results.
5. False positives/negatives: Abnormal packet behavior may cause misinterpretation of scan results.

Conclusion

Nmap isn’t just a port scanner—it’s a network manipulation framework capable of crafting highly customized packets to meet advanced reconnaissance and testing needs. With options like --data, --ttl, --source-port, and --ip-options, users can manipulate packets to bypass filters, test defenses, and investigate system behaviors.

Whether you’re a penetration tester, red teamer, or researcher, mastering these features opens up new dimensions of what Nmap can do. As always, use such capabilities ethically and legally—only scan networks you own or are authorized to test.

By combining custom packet manipulation with Nmap’s NSE scripts and scan types, you can create a powerful toolkit for almost any reconnaissance scenario.

Further Reading and Tools:

• Nmap Reference Guide
• NSE Script Index
• Scapy for deeper packet crafting
• Wireshark for packet analysis

Have you used custom packet manipulation in Nmap before? Share your tips or experiences in the comments below!