tundeep

tundeep provides Layer 2 VPN and injection capabilities, operating primarily in user space except for its pcap dependency. This makes it lightweight and suitable for scenarios where kernel-level access is limited or undesirable. The tool is designed for network tunneling and manipulation at the data link layer.

Use cases include creating VPN tunnels over UDP, injecting traffic via tap interfaces, and handling both IPv4 and IPv6 configurations. It supports compression, checksum disabling, and BPF filtering for precise traffic control. Common applications involve penetration testing, network diagnostics, or bypassing network restrictions through Layer 2 tunneling.

The tool requires root privileges and dependencies like libc6, libpcap0.8t64, and zlib1g. Installed size is 49 KB, making it efficient for Kali Linux environments.

tundeep uses pcap for packet capture and injection, binding to network interfaces or tap devices. In server mode (-s), it listens on a specified IP (-h) and port (-p); in client mode (-c), it connects to a remote server. It supports tap interfaces (-t for IPv4, -T for IPv6) with configurable IP (-x), mask/prefixlen (-y), and MAC (-u). UDP mode (-d) enables UDP tunneling with remote peer (-e), optional compression (-C), and checksum disabling (-K). BPF filters (-b) allow selective packet processing. The tool handles Layer 2 traffic encapsulation over IP/UDP, operating mostly in user space.