What's does in the packets

Delay: delay every outgoing SYN packets, in order to derive with a few packets information about remote host (NOW: hop distance, TODO: operating system, options support).

Injection: evrytime is required, a the packets outgoing should be deleted, modify, anticipated by your own. The plugins do that.

Explore: the ambiguity that a sniffer face when don't know (and have no way to know) if a packets will be accepted or not. One example (This example is easy to understand, but is neither implemented because have few practical usage): TCP MD5 extension exists. Is an option that add and extension header in the packets. If the header is correct, the packets will be accepted, if is not, will be dropped. Suppose that a sniffer intercept a session with a packet with a bad MD5 checksum, but has not inside the code able to verify it, it will go in a default accept/drop.

Cause: SniffJoke cover the real data with this TCP options, and inject sometime bogus packets with this options too (but artificially damaging the option). It cause that a sniffer need to implement MD5 support, has to verify MD5 in every packets, and forget to intercept 10gigabit/seconds like now a mass surveillance system will does.

This is not a bug: the example done with the MD5 TCP opt will be repeated with ever options, every razor edge TCP congestion status, every differences between OS-stack support. The speed of spreading of a new attack tecniques, the growing of closed-source tech, cause that a sniffer based in high-speed hardware, would be refocused totally.

If you are interested in the status of the art, the plugin section explain the supported injection implemented at the moment.