How to Craft Custom TCP, IP and ICMP Packets with a GUI

You often need one exact packet: a TCP SYN with chosen flags, an IPv6 frame with extension headers, or an ICMP Echo Request whose checksum stays wrong on purpose. A Python script can do that. A visual packet builder can do it too, with the bytes and the decode tree updating as you type — useful when you are exploring a field, teaching a lab, or want a finite burst on an isolated adapter without writing a stacker first.

This article compares Scapy with a GUI workflow in Cat KARAT Packet Builder. Send only on an authorized, isolated lab network. Prefer loopback or a dedicated test segment, keep bursts finite, and never aim traffic at third-party systems.

What a useful crafted packet needs

A custom packet is not just "some IP and a payload":

• The stack is explicit. Ethernet, IPv4 or IPv6, then TCP, ICMP or ICMPv6 — each field set, not guessed later.
• Checksums and lengths are either computed or left wrong on purpose. Mixing those modes by accident turns a negative test into a valid packet, or a valid packet into a drop.
• One segment is not a TCP session. A crafted SYN, ACK or RST is a single frame. It does not perform a handshake unless you use a tool that talks through the operating-system TCP stack.
• You can inspect and repeat it. A decode view, a one-packet pcap, or a script you can run later matters as much as the first send.

Deliberate DNS and UDP error cases — wrong lengths, section-count mismatches, InfoSec presets — are covered in an earlier article. Here the focus is IP, TCP and ICMP.

Option 1: Scapy

Scapy builds packets by stacking layers with /. Official usage docs show Ether()/IP()/TCP() and note that Ethernet type and IP protocol are filled from the upper layer. Defaults are documented: TCP destination port 80, ICMP type echo-request, and checksums computed when the packet is assembled (raw(), show2(), or a send).

from scapy.all import Ether, IP, TCP, ICMP, IPv6, ICMPv6EchoRequest, wrpcap

syn = (Ether(dst="00:11:22:33:44:55", src="00:aa:bb:cc:dd:ee")
       / IP(src="192.0.2.1", dst="198.51.100.2")
       / TCP(sport=40000, dport=80, flags="S", seq=1000, window=8192))
echo = (Ether(dst="00:11:22:33:44:55", src="00:aa:bb:cc:dd:ee")
        / IP(src="192.0.2.1", dst="198.51.100.2")
        / ICMP(type="echo-request"))
v6 = (Ether()
      / IPv6(src="2001:db8::1", dst="2001:db8::2")
      / ICMPv6EchoRequest())
wrpcap("lab.pcap", [syn, echo, v6])

sendp() transmits at layer 2 on an interface you name. There is no built-in loopback-only guard: you choose the interface and the count.

Good for: a scripted, reviewable packet in an existing Python test framework, or a one-off field experiment.

Limits: you own every header. Extension headers, unusual flag combinations and a wrong checksum are all possible, but you write them. A lab colleague who does not want to read Python still needs a GUI or a saved pcap.

Option 2: Cat KARAT Packet Builder

Cat KARAT Packet Builder is a free visual builder. According to the product page and User Guide, you select protocols in Packet Flow, set fields on the protocol tabs, watch Packet View decode the bytes, and send one packet, a burst or a stream. Choosing ICMP selects IPv4; ICMPv6 is used when the IP layer is IPv6.

Checksums and lengths are computed automatically unless an Override is checked — the same rule as in the DNS/UDP article. On the IPv4 tab the overrides include Header Length Override, Total Length Override and Checksum Override (hex). The TCP and ICMP/ICMPv6 tabs each have Checksum Override (hex). Leave them unchecked when the packet should be self-consistent.

A typical IPv4/TCP SYN in the GUI:

1. In Packet Flow, select IPv4 and TCP.
2. On MACs & Control, set destination and source MAC (or Get Source MAC), and a finite Packets per Burst (0 means continuous until Stop). Prefer a small count and a non-zero Interpacket gap.
3. On the IPv4 tab, enter TEST-NET addresses such as 192.0.2.1 → 198.51.100.2. Copy Source IP from NIC is available when the source should match the adapter. Destination, source and identifier can be Fixed, Incr, Decr or Rand.
4. On the TCP tab, set Source Port, Dest. Port, Seq. Number (hex) and Window (hex). The flag checkboxes are labelled Urg. Point Valid, Acknowl. Valid, Push Function, Reset Connect, Sync Sequence and No more Data (URG, ACK, PSH, RST, SYN, FIN). For a SYN, tick Sync Sequence only.
5. Open Packet View and confirm the decode before you send.

For IPv6, select IPv6 in Packet Flow. The IPv6 tab has traffic class, flow label, hop limit and addresses (same increment modes). Extension Headers can add a chain (Hop-by-Hop, Destination, Routing, Fragment, Authentication, ESP). Ext. Header Preset includes ready chains such as Hop-by-Hop with Router Alert, fragment variants, and the full RFC 8200 order; Relink Next Headers fixes the Next Header bytes after you reorder the chain.

For ICMP, select the type (for example 8-Echo Request), then Code, ID and Sequence as the type requires. ICMPv6 types include Echo Request/Reply and the MLD messages; the User Guide notes the IPv6 preset "MLD: Hop-by-Hop + Router Alert" when you build MLD.

You can save the current frame (File > Save Packet) or the whole setup (File > Save Script) and replay it without the window:

Karat --run syn.karat.json --output syn.pcap
Karat --run syn.karat.json --safety-loopback
Karat --validate syn.karat.json
Karat --dry-run --run syn.karat.json

--output writes a pcap and sends nothing. --safety-loopback refuses to transmit unless the adapter is a loopback interface. --dry-run builds the frame and reports it. File-building and dry-run do not need administrator rights; live send and capture need Npcap on Windows.

A starting point such as Preset: TCP SYN burst or Preset: ICMP Echo load (ids tcp_syn, icmp_echo) fills the stack for you. Those presets also set a very large packet count and no delay. Reduce Packets per Burst, add a gap, and keep Safety: loopback only on until you are sure of the target.

KARAT also has TCP Tools (banner, HTTP, match and payload fuzz over a real OS TCP connection) and Field Fuzzing (one field of the current packet written out as a pcap of variants). They are useful later; they are not required to craft a single SYN or Echo Request.

A practical lab workflow

1. Stay on a copy of the plan, on an isolated network. Use documentation addresses (192.0.2.0/24, 198.51.100.0/24, 2001:db8::/32) unless the lab node requires something else.
2. Build the packet in Packet Flow and set MAC, IP and L4 fields. Keep Override off unless the test is a deliberate error case.
3. Read Packet View. Check flags, addresses, the IP protocol, and that the checksum is calculated (or the override you wanted).
4. Write a pcap first. Karat --run script.karat.json --output lab.pcap, or Save Packet. Open the file in Wireshark if you want a second decoder.
5. Send a short burst on loopback, then, only if you are authorized, on a dedicated lab adapter. Options > Safety: loopback only (or --safety-loopback) is the safe default. Packets per Burst = 0 is continuous — avoid it until you need it.

Which tool when?

Editions

Cat KARAT is a free single-edition product: no trial clock, no feature paywall, and no commercial-use restriction. The current release runs on Windows 10/11 64-bit. Live sending and capture need Npcap; file-building and --output / --dry-run do not. A Linux build is available on request.

Explore Cat KARAT Packet Builder →

Limitations

• A crafted TCP segment is not a session. SYN, ACK and RST in Packet Flow are single frames.
• GRE checksum is not computed (hex field), as the User Guide lists under protocol limitations. That does not affect a plain IPv4/TCP or ICMP packet.
• Some lab presets use a large packet count and no inter-packet gap. Treat those counts as a starting point to edit, not as something to fire at a shared network.
• You remain responsible for every packet you transmit.

FAQ

Will KARAT recompute a TCP checksum after I change the payload?
Yes, unless Checksum Override (hex) is checked. The same rule applies to IPv4, ICMP and ICMPv6.

How do I build IPv6 instead of IPv4?
Select IPv6 in Packet Flow. ICMP becomes ICMPv6; DHCP becomes DHCPv6. Set addresses on the IPv6 tab, and use an extension-header preset if you need one.

Can I increment the source IP or TCP ports across a burst?
IPv4 and IPv6 source and destination addresses support Fixed, Incr, Decr and Rand. MAC addresses and VLAN IDs have the same modes. TCP ports are set on the TCP tab for the packet being built.

Does this need an internet connection or a paid license?
No. KARAT is free, and it builds and writes packets offline. Npcap is required only for listing interfaces, live send and capture.