All arguments must be options.
tcpprep is a pcap(3) file pre-processor which creates a cache file which provides "rules" for tcprewrite(1) and tcpreplay(1) on how to process and send packets.
If configured with --enable-debug, then you can specify a verbosity level for debugging output. Higher numbers increase verbosity.
Tcpprep will try to automatically determine the primary function of hosts based on the traffic captured and classify each host as client or server. In order to do so, you must provide a hint to tcpprep as to how to search for clients and servers. Valid hints are:
bridge Bridge mode processes each packet to try to determine if the sender is a client or server. Once all the packets are processed, the results are weighed according to the server/client ratio (--ratio) and systems are assigned an interface. If tcpprep is unable to determine what role a system plays, tcpprep will abort.
router Router mode works just like bridge mode, except that after weighing is done, systems which are undetermined are considered a server if they fall inside a network known to contain other servers. Router has a greater chance of successfully splitting clients and servers but is not 100% foolproof.
client Client mode works just like bridge mode, except that unclassified systems are treated as clients. Client mode should always complete successfully.
server
Server mode works just like bridge mode, except that unclassified systems are
treated as servers. Server mode should always complete successfully.
Specify a comma delimited list of CIDR netblocks to match against the source IP of each packet. Packets matching any of the CIDR's are classified as servers.
Specify a regular expression to match against the source IP of each packet. Packets matching the regex are classified as servers.
Specifies that TCP and UDP traffic should be classified as client or server based upon the destination port of the header.
Specify a comment to be imbedded within the output cache file and later viewed.
By default, tcpprep includes the arguments passed on the command line in the cache file comment (in addition to any user specified --comment). If for some reason you do not wish to include this, specify this option.
Override default of sending all packets stored in the capture file and only send packets which match the provided rule. Rules can be one of:
S:<CIDR1>,... - Source IP must match specified CIDR(s)
D:<CIDR1>,... - Destination IP must match specified CIDR(s)
B:<CIDR1>,... - Both source and destination IP must match specified CIDR(s)
E:<CIDR1>,... - Either IP must match specified CIDR(s)
P:<LIST> - Must be one of the listed packets where the list corresponds to the packet number in the capture file.
-x P:1-5,9,15,72-
would send packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
end of the file
F:'<bpf>'
- BPF filter. See the tcpdump(8) man page for syntax.
Override default of sending all packets stored in the capture file and only send packets which do not match the provided rule. Rules can be one of:
S:<CIDR1>,... - Source IP must not match specified CIDR(s)
D:<CIDR1>,... - Destination IP must not match specified CIDR(s)
B:<CIDR1>,... - Both source and destination IP must not match specified CIDR(s)
E:<CIDR1>,... - Either IP must not match specified CIDR(s)
P:<LIST> - Must not be one of the listed packets where the list corresponds to the packet number in the capture file.
-x P:1-5,9,15,72-
would drop packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
end of the file
This option has not been fully documented.
By default, non-IP traffic which can not be classified as client or server is classified as "client". Specifiying --nonip will reclassify non-IP traffic as "server".
Since a given host may have both client and server traffic being sent to/from it, tcpprep uses a ratio to weigh these packets. If you would like to override the default of 2:1 server to client packets required for a host to be classified as a server, specify it as a floating point value.
By default, auto modes use a minimum network mask length of 30 bits to build networks containing clients and servers. This allows you to override this value. Larger values will increase performance but may provide inaccurate results.
By default, auto modes use a maximum network mask length of 8 bits to build networks containing clients and servers. This allows you to override this value. Larger values will decrease performance and accuracy but will provide greater chance of success.
When enabling verbose mode (-v) you may also specify one or more additional arguments to pass to tcpdump to modify the way packets are decoded. By default, -n and -l are used. Be sure to quote the arguments so that they are not interpreted by tcprewrite. The following arguments are valid: [ -aAeNqRStuvxX ] [ -E spi@ipaddr algo:secret,... ] [ -s snaplen ]
This option has not been fully documented.
For support please use the tcpreplay-users@lists.sourceforge.net mailing list.
Released under the Free BSD License.
This manual page was AutoGen-erated from the tcpprep option definitions.