tcpprep_opts.def 16 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598
  1. autogen definitions options;
  2. copyright = {
  3. date = "2000 - 2007";
  4. owner = "Aaron Turner";
  5. type = "bsd";
  6. author = <<- EOText
  7. Copyright 2000-2007 Aaron Turner
  8. For support please use the tcpreplay-users@lists.sourceforge.net mailing list.
  9. The latest version of this software is always available from:
  10. http://tcpreplay.synfin.net/
  11. EOText;
  12. };
  13. package = "tcpprep";
  14. prog-name = "tcpprep";
  15. prog-title = "Create a tcpreplay cache cache file from a pcap file.";
  16. long-opts;
  17. gnu-usage;
  18. help-value = "H";
  19. save-opts-value = "";
  20. load-opts-value = "";
  21. config-header = "config.h";
  22. include = "#include \"defines.h\"\n"
  23. "#include \"common.h\"\n"
  24. "#include \"config.h\"\n"
  25. "#include \"tcpprep.h\"\n"
  26. "#include <stdlib.h>\n"
  27. "#include <string.h>\n"
  28. "extern tcpprep_opt_t options;\n";
  29. homerc = "$$/";
  30. explain = <<- EOExplain
  31. tcpprep is a @file{pcap(3)} file pre-processor which creates a cache
  32. file which provides "rules" for @file{tcprewrite(1)} and @file{tcpreplay(1)}
  33. on how to process and send packets.
  34. EOExplain;
  35. detail = <<- EODetail
  36. The basic operation of tcpreplay is to resend all packets from the
  37. input file(s) out a single file. Tcpprep processes a pcap file and
  38. applies a set of user-specified rules to create a cache file which
  39. tells tcpreplay wether or not to send each packet and which interface the
  40. packet should be sent out of.
  41. For more details, please see the Tcpreplay Manual at:
  42. http://tcpreplay.synfin.net/trac/wiki/manual
  43. EODetail;
  44. man-doc = <<- EOMan
  45. .SH "SEE ALSO"
  46. tcpdump(1), tcprewrite(1), tcpreplay(1)
  47. EOMan;
  48. flag = {
  49. ifdef = DEBUG;
  50. name = dbug;
  51. value = d;
  52. arg-type = number;
  53. max = 1;
  54. immediate;
  55. arg-range = "0->5";
  56. arg-default = 0;
  57. descrip = "Enable debugging output";
  58. doc = <<- EOText
  59. If configured with --enable-debug, then you can specify a verbosity
  60. level for debugging output. Higher numbers increase verbosity.
  61. EOText;
  62. };
  63. /* Modes: -a bridge/router/client/server, -c (cidr) */
  64. flag = {
  65. name = auto;
  66. value = a;
  67. descrip = "Auto-split mode";
  68. arg-type = string;
  69. max = 1;
  70. flags-cant = cidr;
  71. flags-cant = port;
  72. flags-cant = regex;
  73. flags-cant = mac;
  74. flag-code = <<- EOAuto
  75. options.mode = AUTO_MODE;
  76. if (strcmp(OPT_ARG(AUTO), "bridge") == 0) {
  77. options.automode = BRIDGE_MODE;
  78. }
  79. else if (strcmp(OPT_ARG(AUTO), "router") == 0) {
  80. options.automode = ROUTER_MODE;
  81. }
  82. else if (strcmp(OPT_ARG(AUTO), "client") == 0) {
  83. options.automode = CLIENT_MODE;
  84. }
  85. else if (strcmp(OPT_ARG(AUTO), "server") == 0) {
  86. options.automode = SERVER_MODE;
  87. }
  88. else if (strcmp(OPT_ARG(AUTO), "first") == 0) {
  89. options.automode = FIRST_MODE;
  90. }
  91. else {
  92. errx(1, "Invalid auto mode type: %s", OPT_ARG(AUTO));
  93. }
  94. EOAuto;
  95. doc = <<- EOText
  96. Tcpprep will try to automatically determine the primary function of hosts
  97. based on the traffic captured and classify each host as client or server.
  98. In order to do so, you must provide a hint to tcpprep as to how to search
  99. for clients and servers. Valid hints are:
  100. @table @bullet
  101. @item
  102. @var{bridge}
  103. Bridge mode processes each packet to try to determine if the sender is a
  104. client or server. Once all the packets are processed, the results are weighed
  105. according to the server/client ratio (@samp{--ratio}) and systems are assigned an
  106. interface. If tcpprep is unable to determine what role a system plays, tcpprep
  107. will abort.
  108. @item
  109. @var{router}
  110. Router mode works just like bridge mode, except that after weighing is done,
  111. systems which are undetermined are considered a server if they fall inside a
  112. network known to contain other servers. Router has a greater chance of
  113. successfully splitting clients and servers but is not 100% foolproof.
  114. @item
  115. @var{client}
  116. Client mode works just like bridge mode, except that unclassified systems are
  117. treated as clients. Client mode should always complete successfully.
  118. @item
  119. @var{server}
  120. Server mode works just like bridge mode, except that unclassified systems are
  121. treated as servers. Server mode should always complete successfully.
  122. @item
  123. @var{first}
  124. First mode works by looking at the first time each IP is seen in the SRC and DST
  125. fields in the IP header. If the host is first seen in the SRC field, it is a
  126. client and if it's first seen in the DST field, it is marked as a server. This
  127. effectively replicates the processing of the tomahawk test tool. First
  128. mode should always complete successfully.
  129. @end table
  130. EOText;
  131. };
  132. flag = {
  133. name = cidr;
  134. value = c;
  135. descrip = "CIDR-split mode";
  136. arg-type = string;
  137. max = 1;
  138. flags-cant = auto;
  139. flags-cant = port;
  140. flags-cant = regex;
  141. flags-cant = mac;
  142. flag-code = <<- EOCidr
  143. char *cidr = safe_strdup(OPT_ARG(CIDR));
  144. options.mode = CIDR_MODE;
  145. if (!parse_cidr(&options.cidrdata, cidr, ","))
  146. errx(1, "Unable to parse CIDR map: %s", OPT_ARG(CIDR));
  147. free(cidr);
  148. EOCidr;
  149. doc = <<- EOText
  150. Specify a comma delimited list of CIDR netblocks to match against
  151. the source IP of each packet. Packets matching any of the CIDR's
  152. are classified as servers.
  153. EOText;
  154. };
  155. flag = {
  156. name = regex;
  157. value = r;
  158. descrip = "Regex-split mode";
  159. arg-type = string;
  160. max = 1;
  161. flags-cant = auto;
  162. flags-cant = port;
  163. flags-cant = cidr;
  164. flags-cant = mac;
  165. flag-code = <<- EORegex
  166. int regex_error;
  167. char ebuf[EBUF_SIZE];
  168. options.mode = REGEX_MODE;
  169. if ((regex_error = regcomp(&options.preg, OPT_ARG(REGEX),
  170. REG_EXTENDED|REG_NOSUB))) {
  171. regerror(regex_error, &options.preg, ebuf, EBUF_SIZE);
  172. errx(1, "Unable to compile regex: %s", ebuf);
  173. }
  174. EORegex;
  175. doc = <<- EOText
  176. Specify a regular expression to match against the source IP of each
  177. packet. Packets matching the regex are classified as servers.
  178. EOText;
  179. };
  180. flag = {
  181. name = port;
  182. value = p;
  183. descrip = "Port-split mode";
  184. max = 1;
  185. flags-cant = auto;
  186. flags-cant = regex;
  187. flags-cant = cidr;
  188. flags-cant = mac;
  189. flag-code = <<- EOPort
  190. options.mode = PORT_MODE;
  191. EOPort;
  192. doc = <<- EOText
  193. Specifies that TCP and UDP traffic should be classified as client
  194. or server based upon the destination port of the header.
  195. EOText;
  196. };
  197. flag = {
  198. name = mac;
  199. value = e;
  200. arg-type = string;
  201. max = 1;
  202. descrip = "Source MAC split mode";
  203. flags-cant = auto;
  204. flags-cant = regex;
  205. flags-cant = cidr;
  206. flags-cant = port;
  207. flag-code = <<- EOMac
  208. options.mode = MAC_MODE;
  209. options.maclist = safe_strdup(OPT_ARG(MAC));
  210. EOMac;
  211. doc = <<- EOText
  212. Specify a list of MAC addresses to match against the source MAC
  213. of each packet. Packets matching one of the values are classified
  214. as servers.
  215. EOText;
  216. };
  217. flag = {
  218. name = comment;
  219. value = C;
  220. arg-type = string;
  221. max = 1;
  222. descrip = "Embeded cache file comment";
  223. flag-code = <<- EOComment
  224. /* our comment_len is only 16bit - myargs[] */
  225. if (strlen(OPT_ARG(COMMENT)) > ((1 << 16) - 1 - MYARGS_LEN))
  226. errx(1, "Comment length %d is longer then max allowed (%d)",
  227. strlen(OPT_ARG(COMMENT)), (1 << 16) - 1 - MYARGS_LEN);
  228. /* save the comment */
  229. options.comment = (char *)safe_malloc(strlen(OPT_ARG(COMMENT)) + 1);
  230. strcpy(options.comment, OPT_ARG(COMMENT));
  231. EOComment;
  232. doc = <<- EOText
  233. Specify a comment to be imbedded within the output cache file and later
  234. viewed.
  235. EOText;
  236. };
  237. flag = {
  238. name = no-arg-comment;
  239. max = 1;
  240. descrip = "Do not embed any cache file comment";
  241. flag-code = <<- EOCode
  242. options.nocomment = 1;
  243. EOCode;
  244. doc = <<- EOText
  245. By default, tcpprep includes the arguments passed on the command line
  246. in the cache file comment (in addition to any user specified --comment).
  247. If for some reason you do not wish to include this, specify this option.
  248. EOText;
  249. };
  250. /* Include/Exclude */
  251. flag = {
  252. name = include;
  253. value = x;
  254. arg-type = string;
  255. max = 1;
  256. descrip = "Include only packets matching rule";
  257. flags-cant = exclude;
  258. flag-code = <<- EOInclude
  259. char *include;
  260. include = safe_strdup(OPT_ARG(INCLUDE));
  261. options.xX.mode = xX_MODE_INCLUDE;
  262. if ((options.xX.mode = parse_xX_str(&options.xX, include, &options.bpf)) == xXError)
  263. errx(1, "Unable to parse include/exclude rule: %s", OPT_ARG(INCLUDE));
  264. free(include);
  265. EOInclude;
  266. doc = <<- EOText
  267. Override default of processing all packets stored in the capture file and only
  268. send/edit packets which match the provided rule. Rules can be one of:
  269. @table @bullet
  270. @item S:<CIDR1>,...
  271. - Source IP must match specified CIDR(s)
  272. @item D:<CIDR1>,...
  273. - Destination IP must match specified CIDR(s)
  274. @item B:<CIDR1>,...
  275. - Both source and destination IP must match specified CIDR(s)
  276. @item E:<CIDR1>,...
  277. - Either IP must match specified CIDR(s)
  278. @item P:<LIST>
  279. - Must be one of the listed packets where the list
  280. corresponds to the packet number in the capture file.
  281. @example
  282. -x P:1-5,9,15,72-
  283. @end example
  284. would process packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
  285. end of the file
  286. @item F:'<bpf>'
  287. - BPF filter. See the @file{tcpdump(8)} man page for syntax.
  288. @end table
  289. EOText;
  290. };
  291. flag = {
  292. name = exclude;
  293. value = X;
  294. arg-type = string;
  295. max = 1;
  296. descrip = "Exclude any packet matching this rule";
  297. flags-cant = include;
  298. flag-code = <<- EOExclude
  299. char *exclude;
  300. exclude = safe_strdup(OPT_ARG(EXCLUDE));
  301. options.xX.mode = xX_MODE_EXCLUDE;
  302. if ((options.xX.mode = parse_xX_str(&options.xX, exclude, &options.bpf)) == xXError)
  303. errx(1, "Unable to parse include/exclude rule: %s", OPT_ARG(EXCLUDE));
  304. free(exclude);
  305. EOExclude;
  306. doc = <<- EOText
  307. Override default of processing all packets stored in the capture file and only
  308. send/edit packets which do NOT match the provided rule. Rules can be one of:
  309. @table @bullet
  310. @item S:<CIDR1>,...
  311. - Source IP must not match specified CIDR(s)
  312. @item D:<CIDR1>,...
  313. - Destination IP must not match specified CIDR(s)
  314. @item B:<CIDR1>,...
  315. - Both source and destination IP must not match specified CIDR(s)
  316. @item E:<CIDR1>,...
  317. - Either IP must not match specified CIDR(s)
  318. @item P:<LIST>
  319. - Must not be one of the listed packets where the list
  320. corresponds to the packet number in the capture file.
  321. @example
  322. -x P:1-5,9,15,72-
  323. @end example
  324. would skip packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
  325. end of the file
  326. @end table
  327. EOText;
  328. };
  329. flag = {
  330. name = cachefile;
  331. value = o;
  332. arg-type = string;
  333. max = 1;
  334. descrip = "Output cache file";
  335. doc = "";
  336. };
  337. flag = {
  338. name = pcap;
  339. value = i;
  340. descrip = "Input pcap file to process";
  341. arg-type = string;
  342. max = 1;
  343. doc = "";
  344. };
  345. flag = {
  346. name = print-comment;
  347. value = P;
  348. arg-type = string;
  349. descrip = "Print embedded comment in the specified cache file";
  350. max = 1;
  351. doc = "";
  352. };
  353. flag = {
  354. name = print-info;
  355. value = I;
  356. arg-type = string;
  357. descrip = "Print basic info from the specified cache file";
  358. max = 1;
  359. doc = "";
  360. };
  361. flag = {
  362. name = print-stats;
  363. value = S;
  364. arg-type = string;
  365. descrip = "Print statistical information about the specified cache file";
  366. max = 1;
  367. doc = "";
  368. };
  369. flag = {
  370. name = services;
  371. value = s;
  372. descrip = "Load services file for server ports";
  373. flags-must = port;
  374. max = 1;
  375. arg-type = string;
  376. doc = <<- EOText
  377. Uses a list of ports used by servers in the same format as of /etc/services:
  378. <service_name> <port>/<protocol> # comment
  379. Example:
  380. http 80/tcp
  381. EOText;
  382. flag-code = <<- EOServices
  383. parse_services(OPT_ARG(SERVICES), &options.services);
  384. EOServices;
  385. };
  386. flag = {
  387. name = nonip;
  388. value = N;
  389. descrip = "Send non-IP traffic out server interface";
  390. max = 1;
  391. flag-code = <<- EONonip
  392. options.nonip = DIR_SERVER;
  393. EONonip;
  394. doc = <<- EOText
  395. By default, non-IP traffic which can not be classified as client
  396. or server is classified as "client". Specifiying @samp{--nonip}
  397. will reclassify non-IP traffic as "server".
  398. EOText;
  399. };
  400. flag = {
  401. name = ratio;
  402. value = R;
  403. arg-type = string;
  404. max = 1;
  405. flags-must = auto;
  406. arg_default = "2.0";
  407. descrip = "Ratio of client to server packets";
  408. doc = <<- EOText
  409. Since a given host may have both client and server traffic being sent
  410. to/from it, tcpprep uses a ratio to weigh these packets. If you would
  411. like to override the default of 2:1 server to client packets required for
  412. a host to be classified as a server, specify it as a floating point value.
  413. EOText;
  414. };
  415. flag = {
  416. name = minmask;
  417. value = m;
  418. descrip = "Minimum network mask length in auto mode";
  419. flags-must = auto;
  420. max = 1;
  421. arg-type = number;
  422. arg-range = "0->32";
  423. arg_default = 30;
  424. doc = <<- EOText
  425. By default, auto modes use a minimum network mask length of 30 bits
  426. to build networks containing clients and servers. This allows you
  427. to override this value. Larger values will increase performance but
  428. may provide inaccurate results.
  429. EOText;
  430. };
  431. flag = {
  432. name = maxmask;
  433. value = M;
  434. descrip = "Maximum network mask length in auto mode";
  435. flags-must = auto;
  436. max = 1;
  437. arg-type = number;
  438. arg-range = "0->32";
  439. arg_default = 8;
  440. doc = <<- EOText
  441. By default, auto modes use a maximum network mask length of 8 bits
  442. to build networks containing clients and servers. This allows you
  443. to override this value. Larger values will decrease performance
  444. and accuracy but will provide greater chance of success.
  445. EOText;
  446. };
  447. flag = {
  448. ifdef = ENABLE_VERBOSE;
  449. name = verbose;
  450. value = v;
  451. max = 1;
  452. immediate;
  453. descrip = "Print decoded packets via tcpdump to STDOUT";
  454. settable;
  455. doc = "";
  456. };
  457. flag = {
  458. ifdef = ENABLE_VERBOSE;
  459. name = decode;
  460. flags-must = verbose;
  461. value = A;
  462. arg-type = string;
  463. max = 1;
  464. descrip = "Arguments passed to tcpdump decoder";
  465. doc = <<- EOText
  466. When enabling verbose mode (@samp{-v}) you may also specify one or
  467. more additional arguments to pass to @code{tcpdump} to modify
  468. the way packets are decoded. By default, -n and -l are used.
  469. Be sure to quote the arguments so that they are not interpreted
  470. by tcprewrite. The following arguments are valid:
  471. [ -aAeNqRStuvxX ]
  472. [ -E spi@ipaddr algo:secret,... ]
  473. [ -s snaplen ]
  474. EOText;
  475. };
  476. flag = {
  477. name = version;
  478. value = V;
  479. descrip = "Print version information";
  480. flag-code = <<- EOVersion
  481. fprintf(stderr, "tcpprep version: %s (build %s)", VERSION, svn_version());
  482. #ifdef DEBUG
  483. fprintf(stderr, " (debug)");
  484. #endif
  485. fprintf(stderr, "\n");
  486. fprintf(stderr, "Copyright 2001-2007 by Aaron Turner <aturner at synfin dot net>\n");
  487. fprintf(stderr, "Cache file supported: %s\n", CACHEVERSION);
  488. #ifdef HAVE_LIBNET
  489. fprintf(stderr, "Compiled against libnet: %s\n", LIBNET_VERSION);
  490. #else
  491. fprintf(stderr, "Not compiled with libnet.\n");
  492. #endif
  493. #ifdef HAVE_WINPCAP
  494. fprintf(stderr, "Compiled against winpcap: %s\n", get_pcap_version());
  495. #else
  496. fprintf(stderr, "Compiled against libpcap: %s\n", get_pcap_version());
  497. #endif
  498. #ifdef ENABLE_64BITS
  499. fprintf(stderr, "64 bit packet counters: enabled\n");
  500. #else
  501. fprintf(stderr, "64 bit packet counters: disabled\n");
  502. #endif
  503. #ifdef ENABLE_VERBOSE
  504. fprintf(stderr, "Verbose printing via tcpdump: enabled\n");
  505. #else
  506. fprintf(stderr, "Verbose printing via tcpdump: disabled\n");
  507. #endif
  508. exit(0);
  509. EOVersion;
  510. doc = "";
  511. };
  512. flag = {
  513. name = less-help;
  514. value = "h";
  515. immediate;
  516. descrip = "Display less usage information and exit";
  517. flag-code = <<- EOHelp
  518. USAGE(EXIT_FAILURE);
  519. EOHelp;
  520. };