Filewatcher File Search File Search
Content Search
» » » » »


Network Expect, a framework for manipulating network packets

Network Expect is a framework that allows to easily build tools that can interact with network traffic. Following a script, traffic can be injected into the network, and decisions can be taken, and acted upon, based on received network traffic. An interpreted language (Tcl) provides branching and high-level control structures to direct the interaction with the network.

Network Expect was heavily influenced and inspired on the Expect program written by Don Libes, which allows to "talk" to interactive programs in a scripted fashion.

The type of things that Network Expect can do are usually very low level network operations, which usually require writing a custom application in a language like C.

Some of the things that Network Expect can do include:

* Generate arbitrary network traffic and inject it into a network at layer 2 or layer 3.

* A wide range of protocols is supported, including 802.1q, ARP, Cisco VTP and DTP, GRE, IPv4, IPv6, ICMP, UDP, TCP (including options), etc.

This Network Expect functionality is very similar to the functionality provided by several packet crafting and forging open source tools like Nemesis, Packit, hping, Scapy, and others.

* Listen for network traffic and take decisions based on the type of traffic received.

* Open a sniffer trace in PCAP format and replay it after changing some values in the original packet capture.

* Emulate network protocols to see how they interact with other speakers of that protocol. For example, emulating a TCP server to investigate approaches to randomization of TCP Initial Sequence Numbers (ISN) can be easily done in Network Expect.

Visit for more information.

Package version:0.20-3


Network Expect

Network Expect is a framework for managing network packets, including
packet crafting, injection, and reception. The framework uses Tcl
(, which provides branching and high-level control
structures to direct the interaction with the network.

NetworkExpect is specially useful for recreating situations that trigger
a problem (bug), for replaying tra


netexpect for Debian

The Network Expect binary is called "nexp".

If you only need to generate traffic then you can use the tgn
command-line traffic generator, which is supplied with the "tgn"
Debian package, and doesn't have the dependency on libwireshark
that the "nexp" command has.

 -- Eloy Paris <>  Thu Feb 10 16:36:24 EST 2011


Just some examples of Network Expect scripts. Their use should be
documented in the comments at the top of the script.

See also


This is Network Expect, version 0.20.

Version 0.20 (March 22, 2012)



NEXP(1)                    [FIXME: manual]                   NEXP(1)

       nexp - A framewo


netexpect (0.20-3) unstable; urgency=low

  * Update build dependencies for new Wireshark 1.8.0 libr


r399 | elparis | 2012-02-13


- Sensible defaults.
- Manual page. (DONE, but on-going)
- Command-line argument processing is a mes

Browse inside netexpect_0.20-3_i386.deb

         [DIR]DEBIAN/ (2)  65535+ mirrors
         [DIR]usr/ (2)  65535+ mirrors

Download netexpect_0.20-3_i386.deb

Results 1 - 1 of 1
Help - FTP Sites List - Software Dir.
Search over 15 billion files
© 1997-2017