Packet injection (also known as forgingpackets or spoofing packets) incomputer networking, is the process of interfering with an establishednetwork connection by means of constructing packets to appear as if they are part of the normal communication stream. Thepacket injection process allows an unknown third party to disrupt or intercept packets from the consenting parties that are communicating, which can lead to degradation or blockage of users' ability to utilize certainnetwork services orprotocols. Packet injection is commonly used inman-in-the-middle attacks anddenial-of-service attacks.
By utilizingraw sockets,NDIS function calls, or direct access to anetwork adapterkernel mode driver, arbitrary packets can be constructed and injected into acomputer network. These arbitrary packets can be constructed from any type of packetprotocol (ICMP,TCP,UDP, and others) since there is full control over thepacket header while the packet is being assembled.
Packet injection has been used for:
Through the process of running apacket analyzer orpacket sniffer on bothnetwork service access points trying to establish communication, the results can be compared. If point A has no record of sending certain packets that show up in the log at point B, and vice versa, then the packet log inconsistencies show that those packets have been forged and injected by an intermediaryaccess point. UsuallyTCP resets are sent to bothaccess points to disrupt communication.[2][3][4]