Re: A simple request?

On Wed, Feb 11, 2004 at 11:20:34AM -0800, Mike Schiffman wrote:
> Hi there. As some of you may know I'm slated to speak at The RSA 
> Conference on Feb 25th. My topic of choice is "The Evolution of 
> Libnet". I created a slick presentation using OS X's Keynote and let me 
> tell you, it was dialed in. As none of you know, I lost this 
> presentation in an unfortunate HD crash. I'm in the process of 
> scrambling together to recreate what amounted to probably 50 hours or 
> more of work... What I'm asking of you, the loyal libnet users, is 
> simple: How would you explain libnet to a crowd of neophytes? 
> Specifically:
> 
> - What do you like about libnet?
> - What would you like to see explained?
> 
> Any suggestions anyone has might help me jumpstart version two of this 
> presentation. Thanks guys.

A discussion about libnet came up over dinner a week or so back and I've
been writing things with libnet lately, so its awesomeness if fresh in
my mind.

Things I like:

Platform independent packet injection.  You can write clean, concise and
clear code *once*, and with few exceptions it'll compile and "just work"
on Win32, Linux, *BSD, Solaris, etc, i386, PPC, Sparc.  The list goes
on.  Imagine having to rewrite your code for each OS and architecture
that you wanted your code to compile and run on.  Different libraries,
different headers, endianness.  No thanks.

If you can think like the stack, you can write code using libnet.  Build
data/options, build application layer, build transport, slap in a little
IP and ethernet to taste, and you are good to go.  

libnet is flexible enough to satisfy those that have an intimate
relationship with the TCP/IP stack or want to write methods for some (as
of yet) unimplemented protocol, yet sane enough to satisfy those that
just want the simple things.

libnet isn't just some lame toolkit that only an insignificant handful
of people use, its used by some very respectible
organizations/projects/people:

	Snort
	dsniff
	nessus

The documentation and examples are wonderful.  Well, the documentation
currently is a work in progress, but past documentation was great.  If I
can't find something in the documentation, I can look at the sample code
to figure out my issue.  Or I could look at your book (Building Open
Source Network Security Tools).

libnet is more than just a packet injection API.  it provides the user
with a simple interface to functions that are commonly used in
networking code.  I'm talking about some of the miscelaneous functions
that make life easier.  Think the following sections from a past libnet
man page: ADDRESS RESOLUTION FUNCTIONS, MISCELLANEOUS SUPPORT FUNCTIONS


Things I'd like to see explained:

Where/why/how libnet started, where its been, and where its going.

A quick libnet overview.  Start from initialization, to slapping
together various parts of your datagram and then the eventual writing
and cleanup.

Write some code that does something most people are familiar with and
likely understand.  DNS lookup, ping, traceroute, SYN scan, etc.

How to write your own packet building functions.


Good luck with your talk,

-jon