FAQ.lyx 24 KB

  1. #LyX 1.3 created this file. For more info see http://www.lyx.org/
  2. \lyxformat 221
  3. \textclass article
  4. \language english
  5. \inputencoding latin1
  6. \fontscheme times
  7. \graphics default
  8. \paperfontsize default
  9. \spacing single
  10. \papersize letterpaper
  11. \paperpackage a4
  12. \use_geometry 1
  13. \use_amsmath 0
  14. \use_natbib 0
  15. \use_numerical_citations 0
  16. \paperorientation portrait
  17. \leftmargin 10mm
  18. \topmargin 10mm
  19. \rightmargin 10mm
  20. \bottommargin 15mm
  21. \secnumdepth 4
  22. \tocdepth 3
  23. \paragraph_separation skip
  24. \defskip medskip
  25. \quotes_language english
  26. \quotes_times 2
  27. \papercolumns 1
  28. \papersides 1
  29. \paperpagestyle default
  30. \layout Title
  31. Tcpreplay 3.x FAQ
  32. \layout Author
  33. Aaron Turner
  34. \newline
  35. http://tcpreplay.sourceforge.net/
  36. \layout Standard
  37. \pagebreak_top \pagebreak_bottom
  38. \begin_inset LatexCommand \tableofcontents{}
  39. \end_inset
  40. \layout Section
  41. General Info
  42. \layout Subsection
  43. What is this FAQ for?
  44. \layout Standard
  45. Tcpreplay is a suite of powerful tools, but with that power comes complexity.
  46. While I have done my best to write good man pages for tcpreplay and it's
  47. associated utilities, I understand that many people may want more information
  48. then I can provide in the man pages.
  49. Additionally, this FAQ attempts to cover material which I feel will be
  50. of use to people using tcpreplay, as well as common questions that occur
  51. on the Tcpreplay-Users <tcpreplay-users@lists.sourceforge.net> mailing list.
  52. \layout Subsection
  53. What tools come with tcpreplay?
  54. \layout Itemize
  55. tcpreplay - replay ethernet packets stored in a pcap file as they were captured
  56. \layout Itemize
  57. tcprewrite - edit packets stored in a pcap file
  58. \layout Itemize
  59. tcpprep - a pcap pre-processor for tcpreplay
  60. \layout Itemize
  61. flowreplay
  62. \begin_inset Foot
  63. collapsed true
  64. \layout Standard
  65. Flowreplay is still
  66. \begin_inset Quotes eld
  67. \end_inset
  68. alpha
  69. \begin_inset Quotes erd
  70. \end_inset
  71. quality and is not usable for most situations.
  72. Anyone interested in helping me develop flowreplay is encouraged to contact
  73. me.
  74. \end_inset
  75. - connects to a server(s) and replays the client side of the connection
  76. stored in a pcap file
  77. \layout Subsection
  78. What tools no longer come with Tcpreplay?
  79. \layout Standard
  80. Recently, other people and projects have developed better versions of two
  81. applications that ship with tcpreplay 2.x:
  82. \layout Itemize
  83. pcapmerge - merges two or more pcap files into one.
  84. Ethereal now ships with a more powerful appliation called 'mergecap'.
  85. \layout Itemize
  86. capinfo - displays basic information about a pcap file.
  87. Ethereal now ships with a more powerful application of the same name.
  88. \layout Subsection
  89. How can I get tcpreplay's source?
  90. \layout Standard
  91. The source code is available in tarball format on the tcpreplay homepage:
  92. \begin_inset LatexCommand \htmlurl{http://tcpreplay.sourceforge.net/}
  93. \end_inset
  94. I also encourage users familiar with Subversion to try checking out the
  95. latest code as it often has additional features and bugfixes not found
  96. in the tarballs.
  97. \layout Standard
  98. svn checkout https://www.synfin.net:444/svn/tcpreplay/trunk tcpreplay
  99. \layout Subsection
  100. What requirements does tcpreplay have?
  101. \layout Enumerate
  102. You'll need recent versions of the libnet
  103. \begin_inset Foot
  104. collapsed true
  105. \layout Standard
  106. http://www.packetfactory.net/libnet/
  107. \end_inset
  108. and libpcap
  109. \begin_inset Foot
  110. collapsed true
  111. \layout Standard
  112. http://www.tcpdump.org/
  113. \end_inset
  114. libraries.
  115. \layout Enumerate
  116. To support the packet decoding feature you'll need tcpdump
  117. \begin_inset Foot
  118. collapsed true
  119. \layout Standard
  120. http://www.tcpdump.org/
  121. \end_inset
  122. installed.
  123. \layout Enumerate
  124. You'll also need a compatible operating system.
  125. Basically, any UNIX-like or UNIX-based operating system should work.
  126. Linux, *BSD, Solaris, OS X and others should all work.
  127. If you find any compatibility issues with any UNIX-like/based OS, please
  128. let me know.
  129. \layout Subsection
  130. Are there binaries available?
  131. \layout Standard
  132. The tcpreplay project does not maintain binaries for any platforms.
  133. However some operating systems such as Debian GNU/Linux (apt-get) and OS
  134. X (fink) have packages available.
  135. Try searching on Google.
  136. \layout Subsection
  137. Is there a Microsoft Windows port?
  138. \layout Standard
  139. Not really.
  140. We had one user port the code over for an old version of tcpreplay to Windows.
  141. Now we're looking for someone to help merge and maintain the code in to
  142. the main development tree.
  143. If you're interested in helping with this please contact Aaron Turner or
  144. the tcpreplay-users list.
  145. Other then that, you can download the tcpreplay-win32.zip file from the
  146. website and give it a go.
  147. Please understand that the Win32 port of tcpreplay comes with no support
  148. whatsoever, so if you run into a problem you're on your own.
  149. \layout Subsection
  150. How is tcpreplay licensed?
  151. \layout Standard
  152. Tcpreplay is licensed under a three clause BSD-style license.
  153. For details see the docs/LICENSE file included with the source code.
  154. \layout Subsection
  155. What is tcpreplay?
  156. \layout Standard
  157. In the simplest terms, tcpreplay is a tool to send network traffic stored
  158. in pcap format back onto the network; basically the exact opposite of tcpdump.
  159. Just to make things more confusing, tcpreplay is also a suite of tools:
  160. tcpreplay, tcpprep, tcprewrite and flowreplay.
  161. \layout Comment
  162. What isn't tcpreplay?
  163. \layout Comment
  164. Tcpreplay is
  165. \emph on
  166. not
  167. \emph default
  168. a tool to replay captured traffic to a server or client.
  169. Specifically, tcpreplay does not have the ability to rewrite IP addresses
  170. to a user-specified value or synchronize TCP sequence and acknowledgment
  171. numbers.
  172. In other words, tcpreplay can't
  173. \begin_inset Quotes eld
  174. \end_inset
  175. connect
  176. \begin_inset Quotes erd
  177. \end_inset
  178. to a server or be used to emulate a server and have clients connect to
  179. it.
  180. If you're looking for that, check out flowreplay.
  181. \layout Subsection
  182. What are some uses for tcpreplay?
  183. \layout Standard
  184. Originally, tcpreplay was written to test network intrusion detection systems
  185. (NIDS), however tcpreplay has been used to test firewalls, routers, and
  186. other network devices.
  187. With the addition of flowreplay, most
  188. \begin_inset Foot
  189. collapsed true
  190. \layout Standard
  191. Note the flowreplay does not support protocols such as ftp which use multiple
  192. connections.
  193. \end_inset
  194. any udp or tcp service on a server can be tested as well.
  195. \layout Subsection
  196. What are some uses for flowreplay?
  197. \layout Standard
  198. A lot of people wanted a tool like tcpreplay, but wanted to be able to replay
  199. traffic
  200. \emph on
  201. to
  202. \emph default
  203. a server.
  204. Since tcpreplay was unable to do this, I developed flowreplay which replays
  205. the data portion of the flow, but recreates the connection to the specified
  206. server(s).
  207. This makes flowreplay an ideal tool to test host intrusion detection systems
  208. (HIDS) as well as captured exploits and security patches when the actual
  209. exploit code is not available.
  210. Please note that flowreplay is still alpha quality code which means it
  211. doesn't work very well (some would argue it doesn't work at all) and is
  212. currently missing some important features.
  213. \layout Subsection
  214. What is the history of tcpreplay?
  215. \layout Standard
  216. Tcpreplay has had quite a few authors over the past five or so years.
  217. One of the advantages of the BSD and GPL licenses is that if someone becomes
  218. unable or unwilling to continue development, anyone else can take over.
  219. \layout Standard
  220. Originally, Matt Undy of Anzen Computing wrote tcpreplay.
  221. Matt released version 1.0.1 sometime in 1999.
  222. Sometime after that, Anzen Computing was (at least partially) purchased
  223. by NFR and development ceased.
  224. \layout Standard
  225. Then in 2001, two people independently started work on tcpreplay: Matt Bing
  226. of NFR and Aaron Turner.
  227. After developing a series of patches (the -adt branch), Aaron attempted
  228. to send the patches in to be included in the main development tree.
  229. \layout Standard
  230. After some discussion between Aaron and Matt Bing, they decided to continue
  231. development together.
  232. Since then, two major rewrites have occured, and more then thirty new features
  233. have been added, including the addition of a number of accessory tools.
  234. \layout Standard
  235. Today, Aaron continues active development of the code.
  236. \layout Section
  237. Bugs, Feature Requests, and Patches
  238. \layout Subsection
  239. Where can I get help, report bugs or contact the developers?
  240. \layout Standard
  241. The best place to get help or report a bug is the Tcpreplay-Users mailing
  242. list:
  243. \newline
  244. \begin_inset LatexCommand \htmlurl{http://lists.sourceforge.net/lists/listinfo/tcpreplay-users}
  245. \end_inset
  246. \layout Subsection
  247. What information should I provide when I report a bug?
  248. \layout Standard
  249. One of the most frustrating things for any developer trying to help a user
  250. with a problem is not enough information.
  251. Please be sure to include
  252. \emph on
  253. at minimum
  254. \emph default
  255. the following information, however any additional information you feel
  256. may be helpful will be appreciated.
  257. \layout Itemize
  258. Version information (output of -V)
  259. \layout Itemize
  260. Command line used (options and arguments)
  261. \layout Itemize
  262. Platform (Red Hat Linux 9 on Intel, Solaris 7 on SPARC, etc)
  263. \layout Itemize
  264. Error message (if available) and/or description of problem
  265. \layout Itemize
  266. If possible, attach the pcap file used (compressed with bzip2 or gzip preferred)
  267. \layout Itemize
  268. The core dump or backtrace if available
  269. \layout Subsection
  270. I have a feature request, what should I do?
  271. \layout Standard
  272. Let us know! Many of the features exist today because users like you asked
  273. for them.
  274. To make a feature request, you can either email the tcpreplay-users mailing
  275. list (see above) or fill out the feature request form on the tcpreplay
  276. SourceForge website.
  277. \layout Subsection
  278. I've written a patch for tcpreplay, how can I submit it?
  279. \layout Standard
  280. I'm always willing to include new features or bug fixes submitted by users.
  281. You may email me directly or the tcpreplay-users mailing list.
  282. Please
  283. \emph on
  284. do not
  285. \emph default
  286. use the Patch Tracker on the tcpreplay SourceForge web site.
  287. But before you start working on adding a feature or fixing a bug in tcpreplay,
  288. please make sure you checkout the latest source code from the Subversion
  289. repository.
  290. Patches against released versions are almost surely not going to apply
  291. cleanly if at all.
  292. \layout Subsection
  293. Patch requirements
  294. \layout Itemize
  295. Be aware that submitting a patch,
  296. \emph on
  297. you are assigning your copyright to me.
  298. \emph default
  299. If this is not acceptable to you, then
  300. \emph on
  301. do not
  302. \emph default
  303. send me the patch! I have people assign their copyright to me to help prevent
  304. licensing issues that may crop up in the future.
  305. \layout Itemize
  306. Please provide a description of what your patch does!
  307. \layout Itemize
  308. Comment your code! I won't use code I can't understand.
  309. \layout Itemize
  310. Make sure you are patching a branch that is still being maintained.
  311. Generally that means that most recent stable and development branches (2.0
  312. and 3.0 at the time of this writing).
  313. \layout Itemize
  314. Make sure you are patching against the most recent release for that branch.
  315. \layout Itemize
  316. Please submit your patch in the unified diff format so I can better understand
  317. what you're changing.
  318. \layout Itemize
  319. Please provide any relevant personal information you'd like listed in the
  320. CREDITS file.
  321. \layout Standard
  322. Please note that while I'm always interested in patches, I may rewrite some
  323. or all of your submission to maintain a consistent coding style.
  324. \layout Section
  325. Understanding tcpprep
  326. \layout Subsection
  327. What is tcpprep?
  328. \layout Standard
  329. Tcpreplay can send traffic out two network cards, however it requires the
  330. calculations be done in real-time.
  331. These calculations can be expensive and can significantly reduce the throughput
  332. of tcpreplay.
  333. \layout Standard
  334. Tcpprep is a libpcap pre-processor for tcpreplay which enables using two
  335. network cards to send traffic without the performance hit of doing the
  336. calculations in real-time.
  337. \layout Subsection
  338. How does tcpprep work?
  339. \layout Standard
  340. Tcpprep reads in a libpcap (tcpdump) formatted capture file and does some
  341. processing to generate a tcpreplay cache file.
  342. This cache file tells tcpreplay which interface a given packet should be
  343. sent out of.
  344. \layout Subsection
  345. Does tcpprep modify my libpcap file?
  346. \layout Standard
  347. No.
  348. \layout Subsection
  349. Why use tcpprep?
  350. \layout Standard
  351. There are three major reasons to use tcpprep:
  352. \layout Enumerate
  353. Tcpprep can split traffic based upon more methods and criteria then tcpreplay.
  354. \layout Enumerate
  355. By pre-processing the pcap, tcpreplay has a higher theoretical maximum throughpu
  356. t.
  357. \layout Enumerate
  358. By pre-processing the pcap, tcpreplay can be more accurate in timing when
  359. replaying traffic at normal speed.
  360. \layout Subsection
  361. Can a cache file be used for multiple (different) libpcap files?
  362. \layout Standard
  363. Cache files have nothing linking them to a given libpcap file, so there
  364. is nothing to stop you from doing this.
  365. However running tcpreplay with a cache file from a different libpcap source
  366. file is likely to cause a lot of problems and is not supported.
  367. \layout Subsection
  368. Why would I want to use tcpreplay with two network cards?
  369. \layout Standard
  370. Tcpreplay traditionally is good for putting traffic on a given network,
  371. often used to test a network intrusion detection system (NIDS).
  372. However, there are cases where putting traffic onto a subnet in this manner
  373. is not good enough- you have to be able to send traffic *through* a device
  374. such as a router, firewall, or bridge.
  375. \layout Standard
  376. In these cases, being able to use a single source file (libpcap) for both
  377. ends of the connection solves this problem.
  378. \layout Subsection
  379. How big are the cache files?
  380. \layout Standard
  381. Very small.
  382. Actual size depends on the number of packets in the dump file.
  383. Two bits of data is stored for each packet.
  384. On a test using a 900MB dump file containing over 500,000 packets, the
  385. cache file was only 150K.
  386. \layout Section
  387. Common Error and Warning Messages
  388. \layout Subsection
  389. Can't open eth0: libnet_select_device(): Can't find interface eth0
  390. \layout Standard
  391. Generally this occurs when the interface (eth0 in this example) is not up
  392. or doesn't have an IP address assigned to it.
  393. \layout Subsection
  394. Can't open lo: libnet_select_device(): Can't find interface lo
  395. \layout Standard
  396. Version 1.1.0 of Libnet is unable to send traffic on the loopback device.
  397. Upgrade to a later release of the Libnet library to solve this problem.
  398. \layout Subsection
  399. Can't open eth0: UID != 0
  400. \layout Standard
  401. Tcpreplay requires that you run it as root.
  402. \layout Subsection
  403. 100000 write attempts failed from full buffers and were repeated
  404. \layout Standard
  405. When tcpreplay displays a message like "100000 write attempts failed from
  406. full buffers and were repeated", this usually means the kernel buffers
  407. were full and it had to wait until memory was available.
  408. This is quite common when replaying files as fast as possible with the
  409. "-R" option.
  410. See the tuning OS section in this document for suggestions on solving this
  411. problem.
  412. \layout Subsection
  413. Invalid mac address: 00:00:00:00:00:00
  414. \layout Standard
  415. Currently tcpreplay reserves the MAC address of 00:00:00:00:00:00 as reserved
  416. for internal use.
  417. Hence you can't rewrite the MAC address of packets to be all zeros.
  418. While we intend to fix this someday it's not currently high on our priority
  419. list, so let us know if we should re-prioritize things.
  420. \layout Subsection
  421. Unable to process test.cache: cache file version missmatch
  422. \layout Standard
  423. Cache files generated by tcpprep and read by tcpreplay are versioned to
  424. allow enhancements to the cache file format.
  425. Anytime the cache file format changes, the version is incremented.
  426. Since this occurs on a very rare basis, this is generally not an issue;
  427. however anytime there is a change, it breaks compatibility with previously
  428. created cache files.
  429. The solution for this problem is to use the same version of tcpreplay and
  430. tcpprep to read/write the cache files.
  431. Cache file versions match the following versions of tcpprep/tcpreplay:
  432. \layout Itemize
  433. Version 1:
  434. \newline
  435. Prior to 1.3.beta1
  436. \layout Itemize
  437. Version 2:
  438. \newline
  439. 1.3.beta2 to 1.3.1/1.4.beta1
  440. \layout Itemize
  441. Version 3:
  442. \newline
  443. 1.3.2/1.4.beta2 to 2.0.3
  444. \layout Itemize
  445. Version 4:
  446. \newline
  447. 2.1.0 and above.
  448. Note that prior to version 2.3.0, tcpprep had a bug which broke cache file
  449. compatibility between big and little endian systems.
  450. \layout Subsection
  451. Skipping SLL loopback packet.
  452. \layout Standard
  453. Your capture file was created on Linux with the 'any' parameter which then
  454. captured a packet on the loopback interface.
  455. However, tcpreplay doesn't have enough information to actual send the packet,
  456. so it skips it.
  457. Specifying a destination and source MAC address (-D and -S) will allow
  458. tcpreplay to send these packets.
  459. \layout Subsection
  460. Packet length (8892) is greater then MTU; skipping packet.
  461. \layout Standard
  462. The packet length (in this case 8892 bytes) is greater then the maximum
  463. transmition unit (MTU) on the outgoing interface.
  464. Tcpreplay must skip the packet.
  465. Alternatively, you can specify the -T option and tcpreplay will truncate
  466. the packet to the MTU size, fix the checksums and send it.
  467. \layout Section
  468. Common Questions from Users
  469. \layout Subsection
  470. Why is tcpreplay not sending all the packets?
  471. \layout Standard
  472. Every now and then, someone emails the tcpreplay-users list, asking if there
  473. is a bug in tcpreplay which causes it not to send all the packets.
  474. This usually happens when the user uses the -t flag or is replaying a high-spee
  475. d pcap file (> 50Mbps, although this number is dependant on the hardware
  476. in use).
  477. \layout Standard
  478. The short version of the answer is: no, we are not aware of any bugs which
  479. might cause a few packets to not be sent.
  480. \layout Standard
  481. The longer version goes something like this:
  482. \layout Standard
  483. If you are running tcpreplay multiple times and are using tcpdump or other
  484. packet sniffer to count the number packets sent and are getting different
  485. numbers, it's not tcpreplay's fault.
  486. The problem lies in one of two places:
  487. \layout Enumerate
  488. It is well known that tcpdump and other sniffers have a problem keeping
  489. up with high-speed traffic.
  490. Furthermore, the OS in many cases
  491. \emph on
  492. lies
  493. \emph default
  494. about how many packets were dropped.
  495. Tcpdump will repeat this lie to you.
  496. In other words, tcpdump isn't seeing all the packets.
  497. Usually this is a problem with the network card, driver or OS kernel which
  498. may or may not be fixable.
  499. Try another network card/driver.
  500. \layout Enumerate
  501. When tcpreplay sends a packet, it actually gets copied to a send buffer
  502. in the kernel.
  503. If this buffer is full, the kernel is supposed to tell tcpreplay that it
  504. didn't copy the packet to this buffer.
  505. If the kernel has a bug which squelches this error, tcpreplay will not
  506. keep trying to send the packet and will move on to the next one.
  507. Currently I am not aware of any OS kernels with this bug, but it is possible
  508. that it exists.
  509. If you find out that your OS has this problem, please let me know so I
  510. can list it here.
  511. \layout Standard
  512. If for some reason, you still think its a bug in tcpreplay, by all means
  513. read the code and tell me how stupid I am.
  514. The do_packets() function in do_packets.c is where tcpreplay processes the
  515. pcap file and sends all of the packets.
  516. \layout Subsection
  517. Can tcpreplay read gzip/bzip2 compressed files?
  518. \layout Standard
  519. Yes, but not directly.
  520. Since tcpreplay can read data via STDIN, you can decompress the file on
  521. the fly like this:
  522. \layout Standard
  523. \emph on
  524. gzcat myfile.pcap.gz | tcpreplay -i eth0 -
  525. \layout Standard
  526. Note that decompressing on the fly will require additional CPU time and
  527. will likely reduce the overall performance of tcpreplay.
  528. \layout Subsection
  529. How fast can tcpreplay send packets?
  530. \layout Standard
  531. First, if performance is important to you, then upgrading to tcpreplay 3.x
  532. is worthwhile since it is more optimized then the 2.x series.
  533. After that, there are a number of variables which effect performance, including
  534. on how you measure it (packets/sec or bytes/sec).
  535. 100Mbps and 120K pps are quite doable.
  536. Generally speaking here are some points to consider:
  537. \layout Itemize
  538. Profiling tcpreplay has shown that a significant amount of time is spent
  539. writing packets to the network.
  540. Hence, your OS kernel implimentation of writing to raw sockets is one of
  541. the most important aspects since that is where tcpreplay spends most of
  542. it's time.
  543. \layout Itemize
  544. Like most network based I/O, it is faster to send the same amount of data
  545. in a few large packets then many small packets.
  546. \layout Itemize
  547. Most operating systems will cache disk reads in RAM; hence making subsequent
  548. access to the file faster the second time.
  549. \layout Itemize
  550. Re-opening small files repeatly will reduce performance.
  551. Consider using mergecap to generate a single large file.
  552. \layout Itemize
  553. Network cards and drivers, disk speed (RPM is more important then seek),
  554. amount of RAM and system bus speed are all important.
  555. \layout Section
  556. Required Libraries and Tools
  557. \layout Subsection
  558. Libpcap
  559. \layout Standard
  560. As of tcpreplay v1.4, you'll need to have libpcap installed on your system.
  561. As of v2.0, you'll need at least version 0.6.0 or better, but I only test
  562. our code with the latest version.
  563. Libpcap can be obtained on the tcpdump homepage
  564. \begin_inset Foot
  565. collapsed true
  566. \layout Standard
  567. \begin_inset LatexCommand \htmlurl{http://www.tcpdump.org/}
  568. \end_inset
  569. \end_inset
  570. .
  571. \layout Subsection
  572. Libnet
  573. \layout Standard
  574. Tcpreplay v1.3 is the last version to support the old libnet API (everything
  575. before 1.1.x).
  576. As of v1.4 you will need to use Libnet 1.1.0 or better which can be obtained
  577. from the Libnet homepage
  578. \begin_inset Foot
  579. collapsed true
  580. \layout Standard
  581. \begin_inset LatexCommand \htmlurl{http://www.packetfactory.net/Projects/Libnet/}
  582. \end_inset
  583. \end_inset
  584. .
  585. \layout Subsection
  586. Libpcapnav
  587. \layout Standard
  588. Starting with v2.0, tcpreplay can use libpcapnav to support the jump offset
  589. feature.
  590. If libpcapnav is not found on the system, that feature will be disabled.
  591. Libpcapnav can be found on the NetDude homepage
  592. \begin_inset Foot
  593. collapsed true
  594. \layout Standard
  595. \begin_inset LatexCommand \htmlurl{http://netdude.sourceforge.net/}
  596. \end_inset
  597. \end_inset
  598. .
  599. \layout Subsection
  600. Tcpdump
  601. \layout Standard
  602. As of 2.0, tcpreplay uses tcpdump (the binary, not code) to decode packets
  603. to STDOUT in a human readable (with practice) format as it sends them.
  604. If you would like this feature, tcpdump must be installed on your system.
  605. \layout Standard
  606. \noun on
  607. Note:
  608. \noun default
  609. The location of the tcpdump binary is hardcoded in tcpreplay at compile
  610. time.
  611. If tcpdump gets renamed or moved, the feature will become disabled.
  612. \layout Section
  613. Other pcap tools available
  614. \layout Subsection
  615. Tools to capture network traffic or decode pcap files
  616. \layout Itemize
  617. tcpdump
  618. \newline
  619. \begin_inset LatexCommand \htmlurl{http://www.tcpdump.org/}
  620. \end_inset
  621. \layout Itemize
  622. ethereal
  623. \newline
  624. \begin_inset LatexCommand \htmlurl{http://www.ethereal.com/}
  625. \end_inset
  626. \layout Itemize
  627. ettercap
  628. \newline
  629. \begin_inset LatexCommand \htmlurl{http://ettercap.sourceforge.net/}
  630. \end_inset
  631. \layout Subsection
  632. Tools to edit pcap files
  633. \layout Itemize
  634. tcpslice
  635. \newline
  636. Splits pcap files into smaller files
  637. \newline
  638. \begin_inset LatexCommand \htmlurl{http://www.tcpdump.org/}
  639. \end_inset
  640. \layout Itemize
  641. mergecap
  642. \newline
  643. Merges two pcap capture files into one
  644. \newline
  645. \begin_inset LatexCommand \htmlurl{http://www.ethreal.com/}
  646. \end_inset
  647. \layout Itemize
  648. pcapmerge
  649. \newline
  650. Merges two or more pcap capture files into one
  651. \newline
  652. \begin_inset LatexCommand \htmlurl{http://tcpreplay.sourceforge.net/}
  653. \end_inset
  654. \layout Itemize
  655. editcap
  656. \newline
  657. Converts capture file formats (pcap, snoop, etc)
  658. \newline
  659. \begin_inset LatexCommand \htmlurl{http://www.ethreal.com/}
  660. \end_inset
  661. \layout Itemize
  662. netdude
  663. \newline
  664. GTK based pcap capture file editor.
  665. Allows editing most anything in the packet.
  666. \newline
  667. \begin_inset LatexCommand \htmlurl{http://netdude.sourceforge.net/}
  668. \end_inset
  669. \layout Subsection
  670. Other useful tools
  671. \layout Itemize
  672. capinfo
  673. \newline
  674. Prints statistics and basic information about a pcap file
  675. \newline
  676. \begin_inset LatexCommand \htmlurl{http://tcpreplay.sourceforge.net/}
  677. \end_inset
  678. \layout Itemize
  679. text2pcap
  680. \newline
  681. Generates a pcap capture file from a hex dump
  682. \newline
  683. \begin_inset LatexCommand \htmlurl{http://www.ethreal.com/}
  684. \end_inset
  685. \layout Itemize
  686. tcpflow
  687. \newline
  688. Extracts and reassembles the data portion on a per-flow basis on live traffic
  689. or pcap capture files
  690. \newline
  691. \begin_inset LatexCommand \htmlurl{http://www.circlemud.org/~jelson/software/tcpflow/}
  692. \end_inset
  693. \the_end