123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368 |
- .TH TCPPREP 1 2007-07-19 "(tcpprep )" "Programmer's Manual"
- .\" DO NOT EDIT THIS FILE (tcpprep.1)
- .\"
- .\" It has been AutoGen-ed Thursday July 19, 2007 at 09:17:45 AM PDT
- .\" From the definitions tcpprep_opts.def
- .\" and the template file agman1.tpl
- .\"
- .SH NAME
- tcpprep \- Create a tcpreplay cache cache file from a pcap file.
- .SH SYNOPSIS
- .B tcpprep
- .\" Mixture of short (flag) options and long options
- .RB [ \-\fIflag\fP " [\fIvalue\fP]]... [" \--\fIopt-name\fP " [[=| ]\fIvalue\fP]]..."
- .PP
- All arguments must be options.
- .PP
- tcpprep is a \fIpcap(3)\fP file pre-processor which creates a cache
- file which provides "rules" for \fItcprewrite(1)\fP and \fItcpreplay(1)\fP
- on how to process and send packets.
- .SH "DESCRIPTION"
- This manual page documents, briefly, the \fBtcpprep\fP command.
- The basic operation of tcpreplay is to resend all packets from the
- input file(s) out a single file. Tcpprep processes a pcap file and
- applies a set of user-specified rules to create a cache file which
- tells tcpreplay wether or not to send each packet and which interface the
- packet should be sent out of.
- For more details, please see the Tcpreplay Manual at:
- http://tcpreplay.synfin.net/trac/wiki/manual
- .SH OPTIONS
- .TP
- .BR \-d " \fInumber\fP, " \--dbug "=" \fInumber\fP
- Enable debugging output.
- This option may appear up to 1 times.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- in the range 0 through 5
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 0
- .sp
- If configured with \--enable-debug, then you can specify a verbosity
- level for debugging output. Higher numbers increase verbosity.
- .TP
- .BR \-a " \fIstring\fP, " \--auto "=" \fIstring\fP
- Auto-split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- cidr, port, regex, mac.
- .sp
- Tcpprep will try to automatically determine the primary function of hosts
- based on the traffic captured and classify each host as client or server.
- In order to do so, you must provide a hint to tcpprep as to how to search
- for clients and servers. Valid hints are:
- .sp 1
- \fBbridge\fP
- Bridge mode processes each packet to try to determine if the sender is a
- client or server. Once all the packets are processed, the results are weighed
- according to the server/client ratio (\fB--ratio\fP) and systems are assigned an
- interface. If tcpprep is unable to determine what role a system plays, tcpprep
- will abort.
- .sp 1
- \fBrouter\fP
- Router mode works just like bridge mode, except that after weighing is done,
- systems which are undetermined are considered a server if they fall inside a
- network known to contain other servers. Router has a greater chance of
- successfully splitting clients and servers but is not 100% foolproof.
- .sp 1
- \fBclient\fP
- Client mode works just like bridge mode, except that unclassified systems are
- treated as clients. Client mode should always complete successfully.
- .sp 1
- \fBserver\fP
- Server mode works just like bridge mode, except that unclassified systems are
- treated as servers. Server mode should always complete successfully.
- .br
- .TP
- .BR \-c " \fIstring\fP, " \--cidr "=" \fIstring\fP
- CIDR-split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- auto, port, regex, mac.
- .sp
- Specify a comma delimited list of CIDR netblocks to match against
- the source IP of each packet. Packets matching any of the CIDR's
- are classified as servers.
- .TP
- .BR \-r " \fIstring\fP, " \--regex "=" \fIstring\fP
- Regex-split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- auto, port, cidr, mac.
- .sp
- Specify a regular expression to match against the source IP of each
- packet. Packets matching the regex are classified as servers.
- .TP
- .BR \-p ", " \--port
- Port-split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- auto, regex, cidr, mac.
- .sp
- Specifies that TCP and UDP traffic should be classified as client
- or server based upon the destination port of the header.
- .TP
- .BR \-e " \fIstring\fP, " \--mac "=" \fIstring\fP
- Source MAC split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- auto, regex, cidr, port.
- .sp
- Specify a list of MAC addresses to match against the source MAC
- of each packet. Packets matching one of the values are classified
- as servers.
- .TP
- .BR \-C " \fIstring\fP, " \--comment "=" \fIstring\fP
- Embeded cache file comment.
- This option may appear up to 1 times.
- .sp
- Specify a comment to be imbedded within the output cache file and later
- viewed.
- .TP
- .BR \--no-arg-comment
- Do not embed any cache file comment.
- This option may appear up to 1 times.
- .sp
- By default, tcpprep includes the arguments passed on the command line
- in the cache file comment (in addition to any user specified \--comment).
- If for some reason you do not wish to include this, specify this option.
- .TP
- .BR \-x " \fIstring\fP, " \--include "=" \fIstring\fP
- Include only packets matching rule.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- exclude.
- .sp
- Override default of processing all packets stored in the capture file and only
- send/edit packets which match the provided rule. Rules can be one of:
- .sp
- .IR "S:<CIDR1>,... "
- - Source IP must match specified CIDR(s)
- .sp
- .IR "D:<CIDR1>,... "
- - Destination IP must match specified CIDR(s)
- .sp
- .IR "B:<CIDR1>,... "
- - Both source and destination IP must match specified CIDR(s)
- .sp
- .IR "E:<CIDR1>,... "
- - Either IP must match specified CIDR(s)
- .sp
- .IR "P:<LIST> "
- - Must be one of the listed packets where the list
- corresponds to the packet number in the capture file.
- .nf
- \-x P:1-5,9,15,72-
- .fi
- would process packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
- end of the file
- .sp
- .IR "F:'<bpf>'"
- - BPF filter. See the \fItcpdump(8)\fP man page for syntax.
- .br
- .TP
- .BR \-X " \fIstring\fP, " \--exclude "=" \fIstring\fP
- Exclude any packet matching this rule.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- include.
- .sp
- Override default of processing all packets stored in the capture file and only
- send/edit packets which do NOT match the provided rule. Rules can be one of:
- .sp
- .IR "S:<CIDR1>,... "
- - Source IP must not match specified CIDR(s)
- .sp
- .IR "D:<CIDR1>,... "
- - Destination IP must not match specified CIDR(s)
- .sp
- .IR "B:<CIDR1>,... "
- - Both source and destination IP must not match specified CIDR(s)
- .sp
- .IR "E:<CIDR1>,... "
- - Either IP must not match specified CIDR(s)
- .sp
- .IR "P:<LIST> "
- - Must not be one of the listed packets where the list
- corresponds to the packet number in the capture file.
- .nf
- \-x P:1-5,9,15,72-
- .fi
- would skip packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
- end of the file
- .br
- .TP
- .BR \-o " \fIstring\fP, " \--cachefile "=" \fIstring\fP
- Output cache file.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-i " \fIstring\fP, " \--pcap "=" \fIstring\fP
- Input pcap file to process.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-P " \fIstring\fP, " \--print-comment "=" \fIstring\fP
- Print embedded comment in the specified cache file.
- .sp
- .TP
- .BR \-I " \fIstring\fP, " \--print-info "=" \fIstring\fP
- Print basic info from the specified cache file.
- .sp
- .TP
- .BR \-S " \fIstring\fP, " \--print-stats "=" \fIstring\fP
- Print statistical information about the specified cache file.
- .sp
- .TP
- .BR \-s " \fIstring\fP, " \--services "=" \fIstring\fP
- Load services file for server ports.
- This option must appear in combination with the following options:
- port.
- .sp
- This option has not been fully documented.
- .TP
- .BR \-N ", " \--nonip
- Send non-IP traffic out server interface.
- .sp
- By default, non-IP traffic which can not be classified as client
- or server is classified as "client". Specifiying \fB--nonip\fP
- will reclassify non-IP traffic as "server".
- .TP
- .BR \-R " \fIstring\fP, " \--ratio "=" \fIstring\fP
- Ratio of client to server packets.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- auto.
- The default \fIstring\fP for this option is:
- .ti +4
- 2.0
- .sp
- Since a given host may have both client and server traffic being sent
- to/from it, tcpprep uses a ratio to weigh these packets. If you would
- like to override the default of 2:1 server to client packets required for
- a host to be classified as a server, specify it as a floating point value.
- .TP
- .BR \-m " \fInumber\fP, " \--minmask "=" \fInumber\fP
- Minimum network mask length in auto mode.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- auto.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- in the range 0 through 32
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 30
- .sp
- By default, auto modes use a minimum network mask length of 30 bits
- to build networks containing clients and servers. This allows you
- to override this value. Larger values will increase performance but
- may provide inaccurate results.
- .TP
- .BR \-M " \fInumber\fP, " \--maxmask "=" \fInumber\fP
- Maximum network mask length in auto mode.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- auto.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- in the range 0 through 32
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 8
- .sp
- By default, auto modes use a maximum network mask length of 8 bits
- to build networks containing clients and servers. This allows you
- to override this value. Larger values will decrease performance
- and accuracy but will provide greater chance of success.
- .TP
- .BR \-v ", " \--verbose
- Print decoded packets via tcpdump to STDOUT.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-A " \fIstring\fP, " \--decode "=" \fIstring\fP
- Arguments passed to tcpdump decoder.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- verbose.
- .sp
- When enabling verbose mode (\fB-v\fP) you may also specify one or
- more additional arguments to pass to \fBtcpdump\fP to modify
- the way packets are decoded. By default, \-n and \-l are used.
- Be sure to quote the arguments so that they are not interpreted
- by tcprewrite. The following arguments are valid:
- [ \-aAeNqRStuvxX ]
- [ \-E spi@ipaddr algo:secret,... ]
- [ \-s snaplen ]
- .TP
- .BR \-V ", " \--version
- Print version information.
- .sp
- .TP
- .BR \-h ", " \--less-help
- Display less usage information and exit.
- .sp
- This option has not been fully documented.
- .TP
- .BR \-H , " \--help"
- Display usage information and exit.
- .TP
- .BR \-! , " \--more-help"
- Extended usage information passed thru pager.
- .TP
- .BR \- " [\fIrcfile\fP]," " \--save-opts" "[=\fIrcfile\fP]"
- Save the option state to \fIrcfile\fP. The default is the \fIlast\fP
- configuration file listed in the \fBOPTION PRESETS\fP section, below.
- .TP
- .BR \- " \fIrcfile\fP," " \--load-opts" "=\fIrcfile\fP," " \--no-load-opts"
- Load options from \fIrcfile\fP.
- The \fIno-load-opts\fP form will disable the loading
- of earlier RC/INI files. \fI--no-load-opts\fP is handled early,
- out of order.
- .SH OPTION PRESETS
- Any option that is not marked as \fInot presettable\fP may be preset
- by loading values from configuration ("RC" or ".INI") file(s).
- The \fIhomerc\fP file is "\fI$$/\fP", unless that is a directory.
- In that case, the file "\fI.tcppreprc\fP"
- is searched for within that directory.
- .SH "SEE ALSO"
- tcpdump(1), tcprewrite(1), tcpreplay(1)
- .SH AUTHOR
- Copyright 2000-2007 Aaron Turner
- For support please use the tcpreplay-users@lists.sourceforge.net mailing list.
- The latest version of this software is always available from:
- http://tcpreplay.synfin.net/
- .PP
- Released under the Free BSD License.
- .PP
- This manual page was \fIAutoGen\fP-erated from the \fBtcpprep\fP
- option definitions.
|