We first downloaded a packet generator called nemesis. This comes in a zip file file nemesis-1.4beta3.zip. We unzipped it to c:\ and then ran the exe file nemesis. It came back with usage instructions. Then we we ran it as 

nemesis tcp

to create a tcp packet for us. It come back with a message saying TCP packet injected. The only problem is that we do not know what is the packet that nemesis creates by default for us. So we sue the -v option or verbose where nemesis tells us what packet it has send across.

nemesis tcp -v

TCP Packet Injection -=- The NEMESIS Project Version 1.4beta3 (Build 22)

                [IP] 196.254.34.0 > 196.254.34.0
             [IP ID] 65286
          [IP Proto] TCP (6)
            [IP TTL] 255
            [IP TOS] 00
    [IP Frag offset] 0000
     [IP Frag flags] 

         [TCP Ports] 65286 > 65286
         [TCP Flags] SYN 
[TCP Urgent Pointer] 0
   [TCP Window Size] 4096
    [TCP Seq number] 2293476

Wrote 40 byte TCP packet.

TCP Packet Injected

Thus we see that nemesis created for a 40 byte bytes packet using some random IP addresses. Lets us now change each and every option in the above packet and also include a payload. 

C:\nemesis-1.4beta3>nemesis tcp -v  -s 1 -P vijay.txt -w 2 -u 3 -x 80 -y 6 -fSA -t 4 -T 5 -I 7 -S 1.1.1.1 -D 70.0.0.3 -a 9 

TCP Packet Injection -=- The NEMESIS Project Version 1.4beta3 (Build 22)

                [IP] 1.1.1.1 > 70.0.0.3
             [IP ID] 7
          [IP Proto] TCP (6)
            [IP TTL] 5
            [IP TOS] 0x04
    [IP Frag offset] 0000
     [IP Frag flags] 

         [TCP Ports] 80 > 6
         [TCP Flags] SYN ACK 
[TCP Urgent Pointer] 3
   [TCP Window Size] 2
    [TCP Ack number] 9
    [TCP Seq number] 1

Wrote 67 byte TCP packet.

TCP Packet Injected

-s 1 make the sequence number 1 and -a sets the acknowledgement number.
-P is followed by the payload of the packet. Vijay.txt contians any arbitrary text that will be send as tcp data. 
-w 2 makes the tcp window size 2
-u 3 set the urgent pointer offset into the data as 3.
-x 80 sets the source port to 8 and -y set the destination port to 6. 
-f allows us to set the flags, S for SYN A for ACK.
-t 4 is for the Type of Service
-T 5 for the Time to live TTL
-I 7 sets the id of the package to 7. 
-S 1.1.1.1 set the source IP address and -D set the sestination to 70.0.0.3. The machine running sort is on 70.0.0.3. 

We will kkep making changes to this packet and then send it across and see how snort responds to it. We keep the above command line argument in a.bat so that we can simply run it each time.