Layer 4 Methods

Layer 4 Methods

Tip

Run python3 start.py DOCTOR first. It tells you whether raw sockets are available, which decides if the SYN, ICMP, OVH-UDP, and amplification methods can run.

On this page

• Requirements
• Connection methods
• Game and voice methods
• Amplification methods
• Proxies
• Worker behaviour

Requirements

flowchart TD
    M[Method] --> R{Raw socket?}
    R -->|yes| S[Build IP/TCP/UDP headers]
    R -->|no| N[Normal socket]
    S --> P[Send packet]
    N --> P

Loading

Need	Methods
Nothing special	TCP, UDP, CPS, CONNECTION, MINECRAFT, MCBOT, MCPE, FIVEM, FIVEM-TOKEN, TS3, VSE
Root or NET_RAW	SYN, ICMP, OVH-UDP, MEM, NTP, DNS, ARD, CLDAP, CHAR, RDP
Proxy list	TCP, CPS, CONNECTION, MINECRAFT, MCBOT
Reflector file	MEM, NTP, DNS, ARD, CLDAP, CHAR, RDP

Run python3 start.py DOCTOR to see whether raw sockets are available.

Connection methods

TCP

Opens a TCP connection and writes 1 KiB of random bytes per send. Works with HTTP, SOCKS4, and SOCKS5 proxies.

python3 start.py TCP 192.0.2.10:80 100 60
python3 start.py TCP 192.0.2.10:80 100 60 5 socks5.txt

UDP

Sends 1 KiB random datagrams. No proxy support.

python3 start.py UDP 192.0.2.10:80 100 60

SYN

Builds raw TCP SYN packets with Impacket. The source address is the local interface address, not a random spoof. Needs root or NET_RAW.

sudo python3 start.py SYN 192.0.2.10:80 100 60

ICMP

Sends raw ICMP echo requests with a random 16–1024 byte payload. The port is ignored and forced to 0 internally.

sudo python3 start.py ICMP 192.0.2.10 100 60

OVH-UDP

Builds raw UDP packets with HTTP-like payloads and random source ports. Useful for testing OVH-style filtering. Needs raw sockets.

sudo python3 start.py OVH-UDP 192.0.2.10:80 100 60

CPS

Opens and closes a connection as fast as possible. Counts one request per successful connect.

CONNECTION

Spawns a helper thread that opens a connection and reads until the peer closes. The parent keeps creating new helpers, so this method grows the thread count for the whole run.

Game and voice methods

Method	Protocol	Notes
MINECRAFT	Java status ping	Sends handshake and status request repeatedly
MCBOT	Java login	Uses BungeeCord-style forwarding, then /register and /login
MCPE	Bedrock ping	UDP payload aimed at Bedrock servers
FIVEM	FiveM getinfo	UDP query
FIVEM-TOKEN	FiveM token	Random UUID and Steam-style GUID
TS3	TeamSpeak 3	Status ping payload
VSE	Valve Source	Server query payload

MCBOT reads the server's protocol version when possible, then falls back to MINECRAFT_DEFAULT_PROTOCOL from config.json. The bot name prefix also comes from config.json (MCBOT).

python3 start.py MCBOT 192.0.2.10:25565 50 60
python3 start.py MCBOT 192.0.2.10:25565 50 60 5 socks5.txt

Amplification methods

Amplification methods send a small request to a reflector and spoof the target as the source. The reflector replies to the target, multiplying the traffic.

Method	Port	Payload
MEM	11211	Memcached gets
NTP	123	NTP monitor request
DNS	53	DNS ANY query
ARD	3283	Apple Remote Desktop
CLDAP	389	CLDAP search
CHAR	19	Chargen
RDP	3389	RDP connection request

sudo python3 start.py DNS 192.0.2.10:80 100 60 dns.txt

The reflector file must contain one IPv4 address per line. See Amplification for scanning and spoofing notes.

Proxies

Only these methods accept a Layer 4 proxy list:

MINECRAFT, MCBOT, TCP, CPS, CONNECTION

The syntax is:

python3 start.py TCP 192.0.2.10:80 100 60 5 socks5.txt

The proxy type is the same numbering used on Layer 7: 1 HTTP, 4 SOCKS4, 5 SOCKS5, 6 random.

Worker behaviour

Each thread waits for the shared start event, then runs its method until the duration ends. Transient socket errors such as EMFILE, ENETUNREACH, or a timeout are logged once and retried with a short backoff. A failing thread does not stop the main process.

start_workers handles thread-creation limits. If the system refuses new threads, it starts as many as it can and reports the shortfall.