Netomize is excited to announce the fifth major release of PacketSmith, version 5.0.0 (codenamed Pinus strobus).

This ambitious release is the culmination of countless hours of R&D to add unparalleled features to PacketSmith.

It features the following additions, fixes and updates: 

1. Added. Integrated Microsoft’s Antimalware Scan Interface (AMSI) detection module to scan frames, streams, and istreams for malicious content.
   • This feature is available via the option -D,–Detect amsi.
   • The included documentation features several real-world use cases that demonstrate the practical value of this feature.
2. Added. Yara-X detection module. Using Yara-X CAPI, we’ve added the capability to scan a frame, TCP/UDP packets, streams and istreams.
   • We have exposed all the major protocols supported by PacketSmith to the Yara compiler and scanner, via custom pattern identifiers (PaIDs), unique to PacketSmith. Think of these PaIDs as domain-specific objects with nested attributes that you can leverage to write powerful and semantic-aware Yara-X rules to detect malicious traffic, targeting different protocols in the same rule.
   • Netomize is not aware of any other tool on the market that possesses such capabilities.
   • This feature is available via the option -D,–Detect yara.
   • Consult the accompanying documentation for an exhaustive technical breakdown and practical implementation examples of this feature.
   • For a sneak peek into Yara-X + PacketSmith Detection Module.
3. Added. DNS parser and dissector over UDP/TCP. All of the DNS headers and records are exposed via the custom Yara-X PaID object dns, which you could use to write detection rules targeting the DNS protocol.
4. The new cmdline option “-F, –Filter arg“, for applying conditional filters to pcap packets.
   • This “global” filter option is added to make it easier to SELECT frames, TCP/UDP packets, TCP/UDP streams over IPv4/IPv6, and ICMPv4/ICMPv6 istreams, across different features.
   • In future releases, PacketSmith will transition toward a centralized filter option model. Most features will utilize this “global” cmdline option as needed, eliminating the requirement for individual sub-options.
   • This option will be called out for every feature that’s dependent on it.
5. Added. ICMPv4/v6 Echo istreams payload reassembly.
   • This is needed and important for payload scanning. In case of data exfiltration, over hundreds of ICMP Echo packets. This feature is request-type aware.
6. Added. Multiple new sections to the configuration file, including
   • [udp_reassembly] -> for configuring various global settings of the UDP reassembler
   • [icmp_reassembly] -> for configuring various global settings of the ICMP Echo reassembler (istreams)
   • [yara] -> for configuring various global settings of the Yara-X engine, scanner and compiler
   • [dns] -> for configuring various global settings of the DNS dissector, such as port numbers

Miscellaneous changes: 

1. Internal. TCP and UDP stream calculation/creation have been “globalized”, whereby such streams are made available throughout the lifetime of the program right after all the underlying protocols have been dissected.
2. Fixed. A bug in the setting of the AECN flag (-n, –tcp_flags).
   • The bit position was miscalculated.
3. Fixed. A bug in the parsing of the IPv4 options (allocating a bigger buffer).
   • This bug was introduced in version 3!
4. Fixed. The IPv6 fragment reassembly was failing to locate the upper raw layer, after the IPv6 layer. The same fix was applied to the IPv4 fragment reassembly.
5. Fixed. Another bug in the IPv6 fragment reassembly was fixed. This one is due to packets containing ESP fragmented layer. The order of parsing the ESP layer in case of fragment reassembly was incorrect.
6. Added. A couple of attributes to various sections in the configuration file
   • The attributes “active_tcp” and “active_udp” in the streams section enable/disable stream creation. Use this setting carefully; disabling it will break certain functionalities.
   • The attribute “allow_ports” to the tcp_reassembly section to specify a list of allowed TCP dst ports for TCP streams. This is added for performance reasons.
     • All TCP streams’ keys with a dst port other than the ones in the list will be purged. 
     • This feature is documented in the “Allow/Exclude Port Numbers” section.
   • The attribute “exclude_ports” to purge UDP streams from the streams bucket based on a defined (dst) port exclusion list. This is added for performance reasons.
     • This feature is documented in the “Allow/Exclude Port Numbers” section.
   • The option to define specific IP ranges for TCP or UDP (across both IPv4 and IPv6) that the engine should purge from a stream type.
     • This feature is documented in the “Skip IP List” section.
     • The entries are defined in the file “streams/skip_ip_list.txt”.
7. Updated. IPv6 address input validation is relaxed to accommodate both standard and compressed formats.
8. Updated. To accurately reflect the underlying implementation logic, the stream directionality has been redefined from “duplex” to “half_duplex”.
9. Significant performance gains have been achieved in the processing and assignment of TCP stream directionality.

Best regards,

M.