## 4 Software Tools
### Modification of the Network Traffic  
Modifying network traffic is the second step in designing tests in a laboratory infrastructure. There are many tools to perform this task [58]. The most popular ones used in the project are listed below. In addition to capturing and analyzing network traffic, Wireshark allows for filters to be set and modified data to be saved in this way. Unfortunately, Wireshark does not offer packet editing capabilities, so its use is limited for the currently considered purpose.  
Scapy (ver. 2.5.0) is a very flexible tool for working with network packets [59]. It allows for the manipulation of virtually every aspect of a packet [60], e.g., creating new packets from scratch, modifying captured packets, or generating and sending them to the network. Additionally, Scapy allows us to have full control over packet design. It allows for packets to be created with any combination of layers, e.g., Ethernet, Internet Protocol (IP), Transmission Control Protocol (TCP), defining their values such as IP addresses, ports, or flags. Scapy can load existing packages from a.pcap file and modify them. We can then edit any field in the packet header. Scapy allows for the editing of transport layer data, such as TCP and User Datagram Protocol (UDP), and application layer data, including data sent over the Hypertext Transfer Protocol (HTTP) or other protocols. It allows for the editing of ports, flags, and specific fields in the packet payload. Scapy handles the dynamic modification of packet fields. It means that when one field is changed, other dependent values, such as the checksum, can be automatically recalculated, ensuring the packet's integrity. Edit mode allows for changes to be made without creating the entire packet from scratch. Once modified, packets can be saved to a new.pcap file for later analysis or network restoration. Scapy also allows for packages to be exported to various formats.  
In this work project, the Scapy package is used to modify MODBUS protocol packages, function codes, IP addresses, and register values.  
Ettercap (ver. 0.8.3) is mainly designed for man-in-the-middle (MITM) attacks that enable the real-time interception, analysis, and modification of network traffic [61]. It can handle both Address Resolution Protocol (ARP) and Domain Name System (DNS) spoofing attacks. Additionally, it can inject malicious code and modify packets on the fly. As a result, Ettercap is widely used in network security testing.  
The most common MITM techniques in Ettercap ARP spoofing involve impersonating MAC addresses on the local area network (LAN). It allows for the interception and modification of traffic between two devices, e.g., a router and the victim's computer. DNS spoofing involves altering the DNS response to redirect traffic from a target website to another, such as a fake phishing site. It is also possible to use Internet Control Message Protocol (ICMP) Redirect, which is the manipulation of ICMP messages to redirect traffic through the attacker's computer.  
Ettercap can analyze unencrypted protocols such as FTP and HTTP in real time. Thanks to such a feature, it is easy to capture login details and other data.  
Ettercap allows for the creation of filters to manipulate packets in real time. Filters make it possible to alter the content of transmitted data, inject malicious code, or capture passwords and other sensitive information. They act as scripts that allow for the modification of selected fields in a packet. This functionality has been used to modify the contents of MODBUS TCP packets in attacks carried out using GAN [62; 63; 64]. The modified network traffic files have been corrected using the tcprewrite command of the Tcpreplay library to correct the checksums of the modified packets.