I know that they can detect traffic by rules, but can they modify packets on the go?

For example, not only detecting HTTP GET but also adding headers to the GET packet.

If they can't, is there an open source program that can do this at a network scale?

  • You might find Trudy and Mallory helpful. – Ugnes Feb 11 '19 at 14:21
  • 1
    "... do this at a network scale" - whatever this exactly is. SoHo networks, small companies, enterprise, ISP, ... all have networks but at a widely different scale. – Steffen Ullrich Feb 11 '19 at 15:45

Snort and Suricata work on the packet level. While they can reassemble a TCP stream for analysis spanning multiple packets they have not the ability for making changes to the data stream which involve changing the length of the data, i.e. adding some HTTP headers or removing content.

While it is possible in inline mode to replace some content with another content the length of the content cannot change. Otherwise all following outgoing and incoming packets in the TCP stream would need to be changed as well in order to match the shift in TCP sequence numbers caused by the modification. It might even be necessary to include new packets into the stream, properly deal with the TCP window etc. At the end this would mean to implement a complete TCP stack and all these changes would also significantly impact the performance.

If they can't, is there an open source program that can do this at a network scale?

Modifying the traffic in a significant way is the domain of application layer gateways (proxies) which can also be added transparently into the network path. For HTTP one could use for example the squid proxy. It comes with some the built-in functionality for checking and modifying the traffic (ACLs, adding header...). For more advanced modification one can provide own ideas using the ICAP or eCAP API.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.