How do I create a UDP packet?

Question

When I perform the following Netcat command and view the packets with Wireshark, it says the UDP packet is malformed.

$ echo "this is a test" | nc -u 127.0.0.1 53

Similarly, using commands like $ echo "this is a test" > /dev/udp/127.0.0.1/53 produce "malformed packet" errors in Wireshark.

The echo command gets sent/delivered to the Netcat server without errors. But this got me wondering: is it possible to manually construct a proper UDP packet with echo or some other native Unix tool(s)?

I'm using Debian and macOS.

Solution 1

Your packet is completely valid, from the viewpoint of IP and UDP. If you expand the protocol details for Ethernet/IP/UDP in the lower pane of Wireshark, you will see that the packet is successfully parsed.

However, as it is destined for port 53, Wireshark attempts to parse it as a DNS packet, which it cannot do (since the string "this is a test" is not a valid DNS request per the RFC 1035 spec).

If you follow the specification at that link, you will be able to construct a packet that is valid when parsed as a DNS request. If you send the packet to another port, you'll notice that Wireshark will no longer parse it as a DNS request and will hence not show that warning.

Solution 2

You can send them to Bash special aliases with redirection.

From Bash manpages:

/dev/tcp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, bash attempts to open the corresponding TCP socket.

/dev/udp/host/port If host is a valid hostname or Internet address, and port is an integer port number or service name, bash attempts to open the corresponding UDP socket.

This will send a UDP packet to 192.168.2.11 to port 8080:

echo "This is a test" > /dev/udp/192.168.2.11/8080

Comments

[user322500]

Thanks for this answer. I've updated my question. Using your method also produces a "malformed packet" error message, unfortunately.