I wanted Burp's intercept-and-edit workflow but for raw packets instead of HTTP, so I built NetBurp. It sits inline via Linux NFQUEUE, pulls each packet into userspace, and lets
you capture → decode → pause → edit → drop/forward at the Ethernet/IP/TCP/UDP/ICMP layers.
What it does:
\- Wireshark-style decode into an editable field tree; edit any header field or the payload (hex), checksums + lengths recomputed automatically.
\- Rule engine (IF proto/ip/port THEN pause/drop/accept/modify), with a GUI builder so you don't have to touch JSON.
\- TCP flow tracking: length-changing edits get seq/ACK translated across the whole connection (mod-2³², RFC-1982 serial arithmetic, retransmit dedup) so the connection stays alive.
\- IPv4 + IPv6 fragment reassembly, out-of-order tolerant (I hand-rolled it because scapy's defragment() mangles OOO input).
\- Tkinter GUI + headless CLI + an offline pcap-editing mode that needs no root — which is also how the whole thing is tested (64 passing tests).
\- Practical primitives: DNS answer spoofing, MAC rewriting (offline), RST injection, TTL manipulation.
Honest limits (because someone will ask):
▎- TLS/HTTPS is ciphertext — you can drop/mangle but not read/edit the HTTP inside. That's a TLS-proxy job (mitmproxy), not raw packet editing.
\- It's Python + single-threaded NFQUEUE, so it's lab-grade, not line-rate.
\- Editing connection-identity fields (ports/seq/IP) mid-flow won't reroute a live connection — that's how TCP works, not a bug.
MIT licensed. Authorized use only — your own hosts or an isolated lab. There's a namespace-based lab script included so you can generate real traffic to intercept on one machine.
Feedback and PRs welcome — especially on protocol coverage and the flow-tracking edge cases.
Source: r/networkautomation · by /u/No-Policy-482