manual.lyx 55 KB

  1. #LyX 1.3 created this file. For more info see
  2. \lyxformat 221
  3. \textclass article
  4. \language english
  5. \inputencoding latin1
  6. \fontscheme times
  7. \graphics default
  8. \paperfontsize default
  9. \spacing single
  10. \papersize letterpaper
  11. \paperpackage a4
  12. \use_geometry 1
  13. \use_amsmath 0
  14. \use_natbib 0
  15. \use_numerical_citations 0
  16. \paperorientation portrait
  17. \leftmargin 10mm
  18. \topmargin 10mm
  19. \rightmargin 10mm
  20. \bottommargin 15mm
  21. \secnumdepth 4
  22. \tocdepth 3
  23. \paragraph_separation skip
  24. \defskip medskip
  25. \quotes_language english
  26. \quotes_times 2
  27. \papercolumns 1
  28. \papersides 1
  29. \paperpagestyle default
  30. \layout Title
  31. Tcpreplay 3.x Manual (BETA)
  32. \layout Author
  33. Aaron Turner
  34. \newline
  36. \layout Section*
  37. Notice
  38. \layout Standard
  39. This document is still in the process of being re-written due to the significant
  40. CLI and configuration file changes between versions 2.x and 3.x.
  41. For the definative source of configuration options, please see the tcpprep,
  42. tcprewrite, tcpreplay and tcpbridge man pages.
  43. \layout Section*
  44. Overview
  45. \layout Standard
  46. Tcpreplay is a suite of utilities for UNIX systems for editing and replaying
  47. network traffic which was previously captured by tools like tcpdump and
  48. ethereal.
  49. The goal of tcpreplay is to provide the means for providing reliable and
  50. repeatible means for testing a variety of network devices such as switches,
  51. router, firewalls, network intrusion detection and prevention systems (IDS
  52. and IPS).
  53. \layout Standard
  54. Tcpreplay provides the ability to classify traffic as client or server,
  55. edit packets at layers 2-4 and replay the traffic at arbitrary speeds onto
  56. a network for sniffing or through a device.
  57. \layout Standard
  58. Some of the advantages of using tcpreplay over using
  59. \begin_inset Quotes eld
  60. \end_inset
  61. exploit code
  62. \begin_inset Quotes erd
  63. \end_inset
  64. are:
  65. \layout Itemize
  66. Since tcpreplay emulates the victim and the attacker, you generally only
  67. need a tcpreplay box and the device under test (DUT)
  68. \layout Itemize
  69. Tests can include background traffic of entire networks without the cost
  70. and effort of setting up dozens of hosts or costly emulators
  71. \layout Itemize
  72. No need to have a
  73. \begin_inset Quotes eld
  74. \end_inset
  75. victim
  76. \begin_inset Quotes erd
  77. \end_inset
  78. host which needs to have the appropriate software installed, properly configure
  79. d and rebuilt after compromise
  80. \layout Itemize
  81. Less chance that a virus or trojan might escape your network and wreak havoc
  82. on your systems
  83. \layout Itemize
  84. Uses the open standard pcap file format for which dozens of command line
  85. and GUI utilities exist
  86. \layout Itemize
  87. Tests are fully repeatable without a complex test harnesses or network configura
  88. tion
  89. \layout Itemize
  90. Tests can be replayed at arbitrary speeds
  91. \layout Itemize
  92. Single command-line interface to learn and integrate into test harness
  93. \layout Itemize
  94. You only need to audit tcpreplay, rather then each and every exploit individuall
  95. y
  96. \layout Itemize
  97. Actively developed and supported by it's author
  98. \layout Subsection*
  99. Using this manual
  100. \layout Standard
  101. The goal of this manual is to provide an idea of what tcpreplay and it's
  102. utilities can do.
  103. It is not however intended to be a complete document which covers every
  104. possible use case or situation.
  105. It is also very much a work in progress and is far from complete and has
  106. numerous errors since a lot of things have changed since tcpreplay 2.x.
  107. It is expected that most of these issues will be ironed out before the
  108. offical 3.0 release is made.
  109. You should keep in mind the following conventions when reading this document:
  110. \layout Itemize
  111. Commands you should run from the command line
  112. \family typewriter
  113. are in monotype
  114. \family default
  115. .
  116. \layout Itemize
  117. Commands that should be run as root will have a '#' in front of them.
  118. \layout Itemize
  119. Commands that should be run as an unprivelged user will have a '$' in front
  120. of them.
  121. \layout Itemize
  122. Text that should be placed in a file
  123. \family typewriter
  124. is in monospace.
  125. \layout Standard
  126. All of the applications shipped with tcpreplay support both short (a single
  127. dash followed by a single character) and long (two dashes followed by multiple
  128. characters) arguments.
  129. For consistancy, this document uses the long option format.
  130. Please review the man pages for the short argument equivalents.
  131. \layout Subsection*
  132. Getting Help
  133. \layout Standard
  134. If you still have a question after reading the Tcpreplay manual, man pages
  135. and FAQ, please contact the Tcpreplay-Users <
  136. t> mailing list.
  137. Note that if you ask a question which has clearly been covered in either
  138. the manual or FAQ, you will most likely be told to RTFM.
  139. Also, please try to explain your problem in detail.
  140. It is very difficult and fustrating to get requests from people seeking
  141. help who only provide vague and incomplete information.
  142. \layout Subsection*
  143. Corrections and additions to the manual
  144. \layout Standard
  145. I've tried to keep this document up to date with the changes in tcpreplay,
  146. but occasionally I get too busy, make a mistake or just forget something.
  147. If you find anything in this document which could be improved upon, please
  148. let me know.
  149. \layout Section*
  150. Getting Tcpreplay working on your system
  151. \layout Subsection*
  152. Getting the source code
  153. \layout Standard
  154. The source code is available as a tarball on the tcpreplay homepage:
  155. \begin_inset LatexCommand \htmlurl{}
  156. \end_inset
  157. I also encourage users familiar with Subversion to try checking out the
  158. latest code as it often has additional features and bugfixes not yet found
  159. in the offical releases.
  160. \layout LyX-Code
  161. $ svn checkout tcpreplay
  162. \layout Subsection*
  163. Requirements
  164. \layout Enumerate
  165. Libnet
  166. \begin_inset Foot
  167. collapsed true
  168. \layout Standard
  170. \end_inset
  171. 1.1.x or better (1.1.3 fixes a checksum bug which effects tcprewrite)
  172. \layout Enumerate
  173. Libpcap
  174. \begin_inset Foot
  175. collapsed true
  176. \layout Standard
  178. \end_inset
  179. 0.6.x or better (0.8.3 or better recommended)
  180. \layout Enumerate
  181. To support the packet decoding feature you'll need tcpdump
  182. \begin_inset Foot
  183. collapsed true
  184. \layout Standard
  186. \end_inset
  187. binary installed.
  188. \layout Enumerate
  189. You'll also need a compatible operating system.
  190. Basically, any *NIX operating system should work.
  191. Linux, *BSD, Solaris, OS X and others should all work.
  192. If you find any compatibility issues with any *NIX OS, please let me know.
  193. \layout Subsection*
  194. Compiling Tcpreplay
  195. \layout Standard
  196. Two easy steps:
  197. \layout LyX-Code
  198. \emph on
  199. $
  200. \emph default
  201. ./configure && make
  202. \emph on
  203. \layout LyX-Code
  204. \emph on
  205. #
  206. \emph default
  207. make install
  208. \layout Standard
  209. There are some optional arguments which can be passed to the 'configure'
  210. script which may help in cases where your libnet, libpcap or tcpdump installati
  211. on is not standard or if it can't determine the correct network interface
  212. card to use for testing.
  213. I also recommend that for beta code you specify
  214. \series bold
  215. -\SpecialChar \textcompwordmark{}
  216. -enable-debug
  217. \series default
  218. to the configure script in case you find any bugs.
  219. If you find that configure isn't completing correctly, run:
  220. \emph on
  221. ./configure -\SpecialChar \textcompwordmark{}
  222. -help
  223. \emph default
  224. for more information.
  225. \layout Standard
  226. You may also choose to run:
  227. \layout LyX-Code
  228. #
  229. \emph on
  230. make test -i
  231. \layout Itemize
  232. make test is just a series of sanity checks which try to find serious bugs
  233. (crashes) in tcpprep and tcpreplay.
  234. \layout Itemize
  235. make test requires at least one properly configured network interface.
  236. If the configure script can't guess what a valid interface is you can specify
  237. it with the -\SpecialChar \textcompwordmark{}
  238. -with-testnic and -\SpecialChar \textcompwordmark{}
  239. -with-testnic2 arguments.
  240. \layout Itemize
  241. If make test fails, often you can find details in test/test.log.
  242. \layout Itemize
  243. OpenBSD's make has a bug where it ignores the MAKEFLAGS variable in the
  244. Makefile, hence you'll probably want to run:
  245. \emph on
  246. make -is test
  247. \emph default
  248. instead.
  249. \layout Section*
  250. Basic Tcpreplay Usage
  251. \layout Subsection*
  252. Replaying the traffic
  253. \layout Standard
  254. To replay a given pcap as it was captured all you need to do is specify
  255. the pcap file and the interface to send the traffic out interface 'eth0':
  256. \layout LyX-Code
  257. # tcpreplay --intf1=eth0 sample.pcap
  258. \layout Subsection*
  259. Replaying at different speeds
  260. \layout Standard
  261. You can also replay the traffic at different speeds then it was originally
  262. captured
  263. \begin_inset Foot
  264. collapsed true
  265. \layout Standard
  266. Tcpreplay makes a "best" effort to replay traffic at the given rate, but
  267. due to limitations in hardware or the pcap file itself, it may not be possible.
  268. Capture files with only a few packets in them are especially susceptible
  269. to inaccurately timing packets.
  270. \end_inset
  271. .
  272. \layout Standard
  273. Some examples:
  274. \layout Itemize
  275. To replay traffic as quickly as possible:
  276. \layout LyX-Code
  277. # tcpreplay --topspeed --intf1=eth0 sample.pcap
  278. \layout Itemize
  279. To replay traffic at a rate of 10Mbps:
  280. \layout LyX-Code
  281. # tcpreplay --mbps=10.0 --intf1=eth0 sample.pcap
  282. \layout Itemize
  283. To replay traffic 7.3 times as fast as it was captured:
  284. \layout LyX-Code
  285. # tcpreplay --multiplier=7.3 --intf1=eth0 sample.pcap
  286. \layout Itemize
  287. To replay traffic at half-speed:
  288. \layout LyX-Code
  289. # tcpreplay --multiplier=0.5 --intf1=eth0 sample.pcap
  290. \layout Itemize
  291. To replay at 25 packets per second:
  292. \layout LyX-Code
  293. # tcpreplay --pps=25 --intf1=eth0 sample.pcap
  294. \layout Subsection*
  295. Replaying files multiple times
  296. \layout Standard
  297. Using the loop flag you can specify that a pcap file will be sent two or
  298. more times
  299. \begin_inset Foot
  300. collapsed true
  301. \layout Standard
  302. Looping files resets internal counters which control the speed that the
  303. file is replayed.
  304. Also because the file has to be closed and re-opened, an added delay between
  305. the last and first packet may occur.
  306. \end_inset
  307. :
  308. \layout Standard
  309. To replay the sample.pcap file 10 times:
  310. \layout LyX-Code
  311. # tcpreplay --loop=10 --intf1=eth0 sample.pcap
  312. \layout Standard
  313. To replay the sample.pcap an infinitely or until CTRL-C is pressed:
  314. \layout LyX-Code
  315. # tcpreplay --loop=0 --intf1=eth0 sample.pcap
  316. \layout Section*
  317. Editing Packets
  318. \layout Standard
  319. There are a number of ways you can edit packets stored in a pcap file:
  320. \layout Enumerate
  321. Rewriting IP addresses so that they appear to be sent from and to different
  322. hosts
  323. \layout Enumerate
  324. Fixing corrupted packets which were truncated by tcpdump or had bad checksums
  325. \layout Enumerate
  326. Adding, removing or changing 802.1q VLAN tags on frames
  327. \layout Enumerate
  328. Rewriting traffic so that it no longer uses
  329. \begin_inset Quotes eld
  330. \end_inset
  331. standard
  332. \begin_inset Quotes erd
  333. \end_inset
  334. TCP or UDP ports for the given service
  335. \layout Enumerate
  336. Changing ethernet MAC addresses so that packets will be accepted by a router
  337. or firewall
  338. \layout Section*
  339. Splitting Traffic
  340. \layout Standard
  341. Anything other then just replaying packets at different speeds requires
  342. additional work and CPU cycles.
  343. While older versions of tcpreplay allowed you to do many of these calculations
  344. while replaying traffic, it had a negative effect on the overall throughput
  345. and performance of tcpreplay.
  346. Hence, these secondary features have been placed in two utilities:
  347. \layout Itemize
  348. tcpprep - Used to categorize packets as originating from clients or servers
  349. \layout Itemize
  350. tcprewrite - Used to edit packets
  351. \layout Standard
  352. By using tcpprep and tcprewrite on a pcap file before sending it using tcpreplay
  353. , many possibilities open up.
  354. A few of these possibilities are:
  355. \layout Subsection*
  356. Classifying client and servers with tcpprep
  357. \layout Standard
  358. Both tcpreplay and tcprewrite process a single pcap file and generate output.
  359. Some features, such as rewriting IP or MAC addresses or sending traffic
  360. out two different interfaces, require tcpreplay and tcprewrite to have
  361. some basic knowledge about which packets were sent by
  362. \begin_inset Quotes eld
  363. \end_inset
  364. clients
  365. \begin_inset Quotes erd
  366. \end_inset
  367. and
  368. \begin_inset Quotes eld
  369. \end_inset
  370. servers
  371. \begin_inset Quotes erd
  372. \end_inset
  373. .
  374. Such classification is often rather arbitrary since for example a SMTP
  375. mail server both accepts inbound email (acts as a server) and forwards
  376. mail to other mail servers (acts as a client).
  377. A webserver might accept inbound HTTP requests, but make client connections
  378. to a SQL server.
  379. \layout Standard
  380. To deal with this problem, tcpreplay comes with tcpprep which provides a
  381. number of manual and automatic classification methods which cover a variety
  382. of situations.
  383. \layout Subsubsection*
  384. Seperating clients and servers automatically
  385. \layout Standard
  386. The easiest way to split clients and servers is to let tcpprep do the classifica
  387. tion for you.
  388. Tcpprep examines the pcap file for TCP three-way handshakes, DNS lookups
  389. and other types of traffic to figure out which IP's mostly act like clients
  390. and which mostly act like servers.
  391. There are four different automatic modes that you can choose between:
  392. \layout Enumerate
  393. Bridge - This is the simplest mode.
  394. Each IP is individually tracked and ranked as a client or server.
  395. However, if any of the hosts do not generate enough
  396. \begin_inset Quotes eld
  397. \end_inset
  398. client
  399. \begin_inset Quotes erd
  400. \end_inset
  401. or
  402. \begin_inset Quotes eld
  403. \end_inset
  404. server
  405. \begin_inset Quotes erd
  406. \end_inset
  407. traffic then tcpprep will abort complaining that it was unable to determine
  408. its classification.
  409. This works best when clients and servers are intermixed on the same subnet.
  410. \layout Enumerate
  411. Client - This works just like bridge mode, except that unknown hosts will
  412. be marked a client.
  413. \layout Enumerate
  414. Server - This works just like bridge mode, except that unknown hosts will
  415. be marked a server.
  416. \layout Enumerate
  417. Router - Hosts are first ranked as client or server.
  418. Then each host is placed in a subnet which is expanded until either all
  419. the unknown hosts are included or the --maxmask is reached.
  420. This works best when clients and servers are on diffierent networks.
  421. \layout Standard
  422. \align center
  423. \noun on
  424. \begin_inset Tabular
  425. <lyxtabular version="3" rows="3" columns="2">
  426. <features>
  427. <column alignment="center" valignment="top" rightline="true" width="0">
  428. <column alignment="center" valignment="top" width="0">
  429. <row>
  430. <cell multicolumn="1" alignment="center" valignment="top" usebox="none">
  431. \begin_inset Text
  432. \layout Standard
  434. \end_inset
  435. </cell>
  436. <cell multicolumn="2" alignment="center" valignment="top" leftline="true" usebox="none">
  437. \begin_inset Text
  438. \layout Standard
  439. \end_inset
  440. </cell>
  441. </row>
  442. <row>
  443. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  444. \begin_inset Text
  445. \layout Standard
  446. \noun on
  447. Step 1:
  448. \noun default
  449. Categorize Clients, Servers and Unknowns
  450. \end_inset
  451. </cell>
  452. <cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
  453. \begin_inset Text
  454. \layout Standard
  455. \noun on
  456. Step 2:
  457. \noun default
  458. Clients and Servers Expand Their Subnets to Include Unknowns
  459. \end_inset
  460. </cell>
  461. </row>
  462. <row>
  463. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  464. \begin_inset Text
  465. \layout Standard
  466. \begin_inset Graphics
  467. filename router-mode1.eps
  468. lyxscale 60
  469. scale 60
  470. keepAspectRatio
  471. \end_inset
  472. \end_inset
  473. </cell>
  474. <cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
  475. \begin_inset Text
  476. \layout Standard
  477. \begin_inset Graphics
  478. filename router-mode2.eps
  479. lyxscale 60
  480. scale 60
  481. keepAspectRatio
  482. \end_inset
  483. \end_inset
  484. </cell>
  485. </row>
  486. </lyxtabular>
  487. \end_inset
  488. \layout Standard
  489. \SpecialChar ~
  490. \SpecialChar ~
  491. \SpecialChar ~
  492. \layout Standard
  493. \align center
  494. \begin_inset Tabular
  495. <lyxtabular version="3" rows="2" columns="1">
  496. <features>
  497. <column alignment="center" valignment="top" width="0">
  498. <row>
  499. <cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
  500. \begin_inset Text
  501. \layout Standard
  502. \noun on
  503. Step 3:
  504. \noun default
  505. Unknowns Now Marked as Clients and Servers
  506. \end_inset
  507. </cell>
  508. </row>
  509. <row>
  510. <cell alignment="center" valignment="top" topline="true" leftline="true" rightline="true" usebox="none">
  511. \begin_inset Text
  512. \layout Standard
  513. \noun on
  514. \begin_inset Graphics
  515. filename router-mode3.eps
  516. lyxscale 60
  517. scale 60
  518. keepAspectRatio
  519. \end_inset
  520. \end_inset
  521. </cell>
  522. </row>
  523. </lyxtabular>
  524. \end_inset
  525. \layout Standard
  526. Classifying clients and servers in automatic mode is as easy as choosing
  527. a pcap file, an output
  528. \begin_inset Quotes eld
  529. \end_inset
  530. tcpprep cache file
  531. \begin_inset Quotes erd
  532. \end_inset
  533. and the mode to use:
  534. \layout LyX-Code
  535. \emph on
  536. $
  537. \emph default
  538. tcpprep --auto=bridge --pcap=input.pcap --cachefile=input.cache
  539. \layout Standard
  540. The above example would split traffic in bridge mode.
  541. Other modes are
  542. \begin_inset Quotes eld
  543. \end_inset
  544. router
  545. \begin_inset Quotes erd
  546. \end_inset
  547. ,
  548. \begin_inset Quotes eld
  549. \end_inset
  550. client
  551. \begin_inset Quotes erd
  552. \end_inset
  553. and
  554. \begin_inset Quotes eld
  555. \end_inset
  556. server
  557. \begin_inset Quotes erd
  558. \end_inset
  559. .
  560. If you wish, you can override the default 2:1 ratio of server vs.
  561. client traffic required to classify an IP as a server.
  562. If for example you wanted to require 3.5 times as much server to client
  563. traffic you would specify it like:
  564. \layout LyX-Code
  565. \emph on
  566. $
  567. \emph default
  568. tcpprep --auto=bridge --ratio=3.5 --pcap=input.pcap --cachefile=input.cache
  569. \layout Subsubsection*
  570. Seperating clients and servers manually by subnet
  571. \layout Standard
  572. Sometimes, you may not want to split traffic based on clients and servers.
  573. The alternative to using on of the automatic modes in this case, is to
  574. use one of the manual modes.
  575. One manual way of differentiating between clients and servers using tcpprep
  576. is by specifying a list of networks in CIDR notation which contain
  577. \begin_inset Quotes eld
  578. \end_inset
  579. servers
  580. \begin_inset Quotes erd
  581. \end_inset
  582. .
  583. Of course the specified CIDR netblocks don't have to contain
  584. \layout Subsection*
  585. Replaying on multiple interfaces
  586. \layout Standard
  587. Tcpreplay can also split traffic so that each side of a connection is sent
  588. out a different interface
  589. \begin_inset Foot
  590. collapsed true
  591. \layout Standard
  592. Note that you can also use the following options to split traffic into two
  593. files using -w and -W which are described later on in this FAQ.
  594. \end_inset
  595. .
  596. In order to do this, tcpreplay needs the name of the second interface (-j)
  597. and a way to split the traffic.
  598. Currently, there are two ways to split traffic:
  599. \layout Enumerate
  600. -C = split traffic by source IP address which is specified in CIDR notation
  601. \layout Enumerate
  602. -c = split traffic according to a tcpprep cachefile
  603. \begin_inset Foot
  604. collapsed true
  605. \layout Standard
  606. For information on generating tcpprep cache files, see the section on tcpprep.
  607. \end_inset
  608. \layout Standard
  609. When splitting traffic, it is important to remember that traffic that matches
  610. the filter is sent out the primary interface (--intf1).
  611. In this case, when splitting traffic by source IP address, you provide
  612. a list of networks in CIDR notation.
  613. For example:
  614. \layout Itemize
  615. To send traffic from out eth0 and everything else out eth1:
  616. \layout LyX-Code
  617. tcpreplay -C --intf1=eth0 --intf2=eth1 sample.pcap
  618. \layout Itemize
  619. To send traffic from and out eth0 and everything else
  620. out eth1:
  621. \layout LyX-Code
  622. tcpreplay -C, --intf1=eth0 --intf2=eth1 sample.pcap
  623. \layout Itemize
  624. After using tcpprep to generate a cache file, you can use it to split traffic
  625. between two interfaces like this:
  626. \layout LyX-Code
  627. tcpreplay -c sample.cache --intf1=eth0 --intf2=eth1 sample.pcap
  628. \layout Subsection*
  629. Selectively sending or dropping packets
  630. \layout Standard
  631. Sometimes, you want to do some post-capture filtering of packets.
  632. Tcpreplay let's you have some control over which packets get sent.
  633. \layout Enumerate
  634. -M = disables sending of martian packets.
  635. By definition, martian packets have a source IP of 0.x.x.x, 127.x.x.x, or 255.x.x.x
  636. \layout Enumerate
  637. -x = send packets which match a specific pattern
  638. \layout Enumerate
  639. -X = send packets which do not match a specific pattern
  640. \layout Standard
  641. Both -x and -X support a variety of pattern matching types.
  642. These types are specified by a single character, followed by a colon, followed
  643. by the pattern.
  644. The following pattern matching types are available:
  645. \layout Enumerate
  646. S - Source IP
  647. \newline
  648. Pattern is a comma delimited CIDR notation
  649. \layout Enumerate
  650. D - Destination IP
  651. \newline
  652. Pattern is a comma delimited CIDR notation
  653. \layout Enumerate
  654. B - Both source and destination IP must match
  655. \newline
  656. Pattern is a comma delimited CIDR notation
  657. \layout Enumerate
  658. E - Either source or destination IP must match
  659. \newline
  660. Pattern is a comma delimited CIDR notation
  661. \layout Enumerate
  662. P - A list of packet numbers from the pcap file.
  663. \newline
  664. Pattern is a series of numbers, separated by commas or dashes.
  665. \layout Enumerate
  666. F - BPF syntax (same as used in tcpdump).
  667. \newline
  668. Filter must be quoted and is only supported with -x
  669. \begin_inset Foot
  670. collapsed true
  671. \layout Standard
  672. Note that if you want to send all the packets which do not match a bpf filter,
  673. all you have to do is negate the bpf filter.
  674. See the tcpdump(1) man page for more info.
  675. \end_inset
  676. .
  677. \layout Standard
  678. Examples:
  679. \layout Itemize
  680. To only send traffic that is too and from a host in
  681. \layout LyX-Code
  682. tcpreplay -x B: --intf1 eth0 sample.pcap
  683. \layout Itemize
  684. To not send traffic that is too or from a host in
  685. \layout LyX-Code
  686. tcpreplay -X E: --intf1 eth0 sample.pcap
  687. \layout Itemize
  688. To send every packet except the first 10 packets:
  689. \layout LyX-Code
  690. tcpreplay -X P:1-10 --intf1 eth0 sample.pcap
  691. \layout Itemize
  692. To only send the first 50 packets followed by packets: 100, 150, 200 and
  693. 250:
  694. \layout LyX-Code
  695. tcpreplay -x P:1-50,100,150,200,250 --intf1 eth0 sample.pcap
  696. \layout Itemize
  697. To only send TCP packets from
  698. \layout LyX-Code
  699. \emph on
  700. tcpreplay -x F:'tcp and host' --intf1 eth0 sample.pcap
  701. \layout Subsection*
  702. Replaying only a few packets
  703. \layout Standard
  704. Using the limit packets flag (-L) you can specify that tcpreplay will only
  705. send at most a specified number of packets.
  706. \layout Itemize
  707. To send at most 100 packets:
  708. \layout LyX-Code
  709. tcpreplay --intf1 eth0 -L 100 sample.pcap
  710. \layout Subsection*
  711. Skipping the first bytes in a pcap file
  712. \layout Standard
  713. If you want to skip the beginning of a pcap file, you can use the offset
  714. flag (-o) to skip a specified number of bytes and start sending on the
  715. next packet.
  716. \layout Itemize
  717. To skip 15Kb into the pcap file and start sending packets from there:
  718. \layout LyX-Code
  719. tcpreplay --intf1=eth0 -o 15000 sample.pcap
  720. \layout Subsection*
  721. Replaying packets which are bigger then the MTU
  722. \layout Standard
  723. Occasionally, you might find yourself trying to replay a pcap file which
  724. contains packets which are larger then the MTU for the sending interface.
  725. This might be due to the packets being captured on the loopback interface
  726. or on a 1000Mbps ethernet interface supporting
  727. \begin_inset Quotes eld
  728. \end_inset
  729. jumbo frames
  730. \begin_inset Quotes erd
  731. \end_inset
  732. .
  733. I've even seen packets which are 1500 bytes but contain both an ethernet
  734. header and trailer which bumps the total frame size to 1518 which is 4
  735. bytes too large.
  736. \layout Standard
  737. By default, tcpreplay will skip these packets and not send them.
  738. Alternatively, you can specify the -T flag to truncate these packets to
  739. the MTU and then send them.
  740. Of course this may invalidate your testing, but it has proven useful in
  741. certain situations.
  742. Also, when this feature is enabled, tcpreplay will automatically recalculate
  743. the IP and TCP, UDP or ICMP checksums as needed.
  744. Example:
  745. \layout LyX-Code
  746. tcpreplay --intf1 eth0 -T sample.pcap
  747. \layout Subsection*
  748. Writing packets to a file
  749. \layout Standard
  750. It's not always necessary to write packets to the network.
  751. Since tcpreplay has so many features which modify and select which packets
  752. are sent, it is occasionally useful to save these changes to another pcap
  753. file for comparison.
  754. Rather then running a separate tcpdump process to capture the packets,
  755. tcpreplay now supports output directly to a file.
  756. Example:
  757. \layout LyX-Code
  758. tcpreplay --intf1 eth0 -w output.pcap -F -u pad -x E: input1.pcap input2.pca
  759. p input3.pcap
  760. \layout Standard
  761. Notice that specifying an interface is still required (required for various
  762. internal functions), but all the packets will be written to
  763. \emph on
  764. output.pcap
  765. \emph default
  766. .
  767. \layout Standard
  768. You can also split traffic into two files by using -W <2nd output file>.
  769. \layout Subsection*
  770. Extracting Application Data (Layer 7)
  771. \layout Standard
  772. New to version 2.0 is the ability to extract the application layer data from
  773. the packets and write them to a file.
  774. In the man page, we call this
  775. \begin_inset Quotes eld
  776. \end_inset
  777. data dump mode
  778. \begin_inset Quotes erd
  779. \end_inset
  780. which is enabled with -D.
  781. It's important to specify -D before -w (and -W if you're splitting data
  782. into two files).
  783. Example:
  784. \layout LyX-Code
  785. tcpreplay -D --intf1 eth0 -j eth0 -w clientdata -W serverdata -C
  786. sample.pcap
  787. \layout Subsection*
  788. Replaying Live Traffic
  789. \layout Standard
  790. You can now replay live traffic sniffed on one network interface and replay
  791. it on another interface using the -S flag to indicate sniff mode and the
  792. appropriate snaplen in bytes (0 denotes the entire packet).
  793. You can also enabling bi-directional traffic using the bridge mode flag:
  794. -b.
  795. \layout Standard
  796. N
  797. \noun on
  798. ote:
  799. \noun default
  800. It is critical for your sanity (and to prevent your murder by your network
  801. administrators) that the input interface and the output interface be on
  802. separate networks and additionally that no other network devices (such
  803. as bridges, switches, routers, etc) be connecting the two networks, else
  804. you will surely get a networkstorm the likes that have not been seen for
  805. years.
  806. \layout Itemize
  807. Send packets sniffed on eth0 out eth1:
  808. \layout LyX-Code
  809. tcpreplay --intf1 eth1 -S 0 eth0
  810. \layout Itemize
  811. Bridge two subnets connected to eth0 and eth1:
  812. \layout LyX-Code
  813. tcpreplay --intf1 eth0 --intf2=eth1 -b -S 0
  814. \layout Standard
  815. By default, tcpreplay listens in promiscuous mode on the specified interface,
  816. however if you only want to send unicasts directed for the local system
  817. and broadcasts, you can specify the
  818. \begin_inset Quotes eld
  819. \end_inset
  820. not_nosy
  821. \begin_inset Quotes erd
  822. \end_inset
  823. option in the configuration file or -n on the command line.
  824. Note that if another program has already placed the interface in promiscuous
  825. mode, the -n flag will have no effect, so you may want to use the -x or
  826. -X argument to limit packets.
  827. \layout Subsection*
  828. Replaying Packet Capture Formats Other Than Libpcap
  829. \layout Standard
  830. There are about as many different capture file formats as there are sniffers.
  831. In the interest of simplicity, tcpreplay only supports libpcap
  832. \begin_inset Foot
  833. collapsed true
  834. \layout Standard
  835. Note that some versions of tcpreplay prior to 1.4 also supported the Solaris
  836. snoop format.
  837. \end_inset
  838. .
  839. If you would like to replay a file in one of these multitude of formats,
  840. the excellent open source tool Ethereal easily allows you to convert it
  841. to libpcap.
  842. For instance, to convert a file in Sun's snoop format to libpcap, issue
  843. the command:
  844. \layout LyX-Code
  845. tethereal -r blah.snoop -w blah.pcap
  846. \layout Standard
  847. and replay the resulting file.
  848. \layout Subsection*
  849. Replaying Client Traffic to a Server
  850. \layout Standard
  851. A common question on the tcpreplay-users list is how does one replay the
  852. client side of a connection back to a server.
  853. Unfortunately, tcpreplay doesn't support this right now.
  854. The major problem concerns syncing up TCP Seq/Ack numbers which will be
  855. different.
  856. ICMP also often contains IP header information which would need to be adjusted.
  857. About the only thing that could be easy to do is UDP, which isn't usually
  858. requested.
  859. \layout Standard
  860. This is however a feature that we're looking into implementing in the flowreplay
  861. utility.
  862. If you're interested in helping work on this feature, please contact us
  863. and we'd be more then happy to work with you.
  864. At this time however, we don't have an ETA when this will be implemented,
  865. so don't bother asking.
  866. \layout Subsection*
  867. Decoding Packets
  868. \layout Standard
  869. If the tcpdump binary is installed on your system when tcpreplay is compiled,
  870. it will allow you to decode packets as they are sent without running tcpdump
  871. in a separate window or worrying about it capturing packets which weren't
  872. sent by tcpreplay.
  873. \layout Itemize
  874. Decode packets as they are sent:
  875. \layout LyX-Code
  876. tcpreplay --intf1 eth0 -v sample.pcap
  877. \layout Itemize
  878. Decode packets with the link level header:
  879. \layout LyX-Code
  880. tcpreplay --intf1 eth0 -v -A
  881. \begin_inset Quotes eld
  882. \end_inset
  883. -e
  884. \begin_inset Quotes erd
  885. \end_inset
  886. sample.pcap
  887. \layout Itemize
  888. Fully decode and send one packet at a time:
  889. \layout LyX-Code
  890. tcpreplay --intf1 eth0 -v -1 -A
  891. \begin_inset Quotes eld
  892. \end_inset
  893. -s0 -evvvxX
  894. \begin_inset Quotes erd
  895. \end_inset
  896. sample.pcap
  897. \layout Standard
  898. Note that tcpreplay automatically applies the -n flag to disable DNS lookups
  899. which would slow down tcpdump too much to make it effective.
  900. \layout Section*
  901. Packet Editing
  902. \layout Subsection*
  903. Rewriting MAC addresses
  904. \layout Standard
  905. If you ever want to send traffic to another device on a switched LAN, you
  906. may need to change the destination MAC address of the packets.
  907. Tcpreplay allows you to set the destination MAC for each interface independentl
  908. y using the -I and -J switches.
  909. As of version 2.1.0, you can also specify the source MAC via -k and -K.
  910. Example:
  911. \layout Itemize
  912. To send traffic out eth0 with a destination MAC of your router (00:00:01:02:03:0
  913. 4) and the source MAC of the server (00:20:30:40:50:60):
  914. \layout LyX-Code
  915. tcpreplay --intf1=eth0 -I 00:00:01:02:03:04 -k 00:20:30:40:50:60 sample.pcap
  916. \layout Itemize
  917. To split traffic between internal ( and external addresses and
  918. to send that traffic to the two interfaces of a firewall:
  919. \layout LyX-Code
  920. tcpreplay --intf1=eth0 --intf2=eth1 -I 00:01:00:00:AA:01 -J 00:01:00:00:AA:02
  921. -C sample.pcap
  922. \layout Subsection*
  923. Randomizing IP addresses
  924. \layout Standard
  925. Occasionally, it is necessary to have tcpreplay rewrite the source and destinati
  926. on IP addresses, yet maintain the client/server relationship.
  927. Such a case might be having multiple copies of tcpreplay running at the
  928. same time using the same pcap file while trying to stress test firewall,
  929. IDS or other stateful device.
  930. If you didn't change the source and destination IP addresses, the device
  931. under test would get confused since it would see multiple copies of the
  932. same connection occurring at the same time.
  933. In order to accomplish this, tcpreplay accepts a user specified seed which
  934. is used to generate pseudo-random IP addresses.
  935. Also, when this feature is enabled, tcpreplay will automatically recalculate
  936. the IP and TCP, UDP or ICMP checksums as needed.
  937. Example:
  938. \layout LyX-Code
  939. \emph on
  940. tcpreplay --intf1=eth0 -s 1239 sample.pcap &
  941. \newline
  942. tcpreplay --intf1=eth0 -s 76 sample.pcap &
  943. \newline
  944. tcpreplay --intf1=eth0 -s 239 sample.pcap &
  945. \newline
  946. tcpreplay --intf1=eth0 sample.pcap
  947. \layout Subsection*
  948. Replaying (de)truncated packets
  949. \layout Standard
  950. Occasionally, it is necessary to replay traffic which has been truncated
  951. by tcpdump.
  952. This occurs when the tcpdump snaplen is smaller then the actual packet
  953. size.
  954. Since this will create problems for devices which are expecting a full-sized
  955. packet or attempting checksum calculations, tcpreplay allows you to either
  956. pad the packet with zeros or reset the packet length in the headers to
  957. the actual packet size.
  958. In either case, the IP and TCP, UDP or ICMP checksums are recalculated.
  959. Examples:
  960. \layout Itemize
  961. Pad truncated packets:
  962. \layout LyX-Code
  963. tcpreplay --intf1=eth0 -u pad sample.pcap
  964. \layout Itemize
  965. Rewrite packet header lengths to the actual packet size:
  966. \layout LyX-Code
  967. tcpreplay --intf1=eth0 -u trunc sample.pcap
  968. \layout Subsection*
  969. Rewriting Layer 2 with -2
  970. \layout Standard
  971. Starting in the 2.0.x branch, tcpreplay can replace the existing layer 2 header
  972. with one of your choosing.
  973. This is useful for when you want to change the layer 2 header type or add
  974. a header for pcap files without one.
  975. Each pcap file tells the type of frame.
  976. Currently tcpreplay knows how to deal with the following pcap(3) frame
  977. types:
  978. \layout Itemize
  979. DLT_EN10MB
  980. \newline
  981. Replace existing 802.3/Ethernet II header
  982. \layout Itemize
  983. DLT_RAW
  984. \newline
  985. Frame has no Layer 2 header, so we can add one.
  986. \layout Itemize
  988. \newline
  989. Frame uses the Linux Cooked Socket header which is most commonly created
  990. with
  991. \emph on
  992. tcpdump -i any
  993. \emph default
  994. on a Linux system.
  995. \layout Standard
  996. Tcpreplay accepts the new Layer 2 header as a string of comma separated
  997. hex values such as: 0xff,0xac,0x00,0x01,0xc0,0x64.
  998. Note that the leading '0x' is
  999. \emph on
  1000. not
  1001. \emph default
  1002. required.
  1003. \layout Standard
  1004. Potential uses for this are to add a layer 2 header for DLT_RAW captures
  1005. or add/remove ethernet tags or QoS features.
  1006. \layout Subsection*
  1007. Rewriting DLT_LINUX_SLL (Linux Cooked Socket) captures
  1008. \layout Standard
  1009. Tcpdump uses a special frame type to store captures created with the
  1010. \begin_inset Quotes eld
  1011. \end_inset
  1012. -i any
  1013. \begin_inset Quotes erd
  1014. \end_inset
  1015. argument.
  1016. This frame type uses a custom 16 byte layer 2 header which tracks which
  1017. interface captured the packet and often the source MAC address of the original
  1018. ethernet frame.
  1019. Unfortunately, it never stores the destination MAC address and it doesn't
  1020. store a source MAC when the packet is captured on the loopback interface.
  1021. Normally, tcpreplay can't replay these pcap files because there isn't enough
  1022. information in the LINUX_SLL header to do so; however two options do exist:
  1023. \layout Enumerate
  1024. You can send these packets with -2 which will replace the LINUX_SLL header
  1025. with an ethernet header of your choosing.
  1026. \layout Enumerate
  1027. You can specify a destination MAC via -I and -J in which case tcpreplay
  1028. will use the stored source MAC and create a new 802.3 Ethernet header.
  1029. Note that if the pcap contains loopback packets, you will also need to
  1030. specify -k and/or -K to specify the source MAC as well or they will be
  1031. skipped.
  1032. \layout Subsection*
  1033. Rewriting IP Addresses (pseudo-NAT)
  1034. \layout Standard
  1035. Pseudo-NAT allows the mapping of IP addresses in IPv4 and ARP packets from
  1036. one subnet to another subnet of the same or different size.
  1037. This allows some or all the traffic sent to appear to come from a different
  1038. IP subnet then it actually was captured on.
  1039. \layout Standard
  1040. The mapping is done through a user specified translation table comprised
  1041. of one or more source and destination network(s) in the format of <srcnet>/<mas
  1042. klen>:<dstnet>/<masklen> deliminated by a comma.
  1043. Mapping is done by matching IP addresses to the source subnet and rewriting
  1044. the most significant bits with the destination subnet.
  1045. For example:
  1046. \layout Standard
  1047. \emph on
  1048. tcpreplay --intf1=eth0 -N sample.pcap
  1049. \layout Standard
  1050. would match any IP in the subnet and rewrite it as if it came
  1051. from or sent to the subnet.
  1052. Ie: would become and would become
  1053. But would not be rewritten.
  1054. \layout Standard
  1055. For any given IP address, the translation table is applied in order (so
  1056. if there are multiple mappings, earlier maps take precedence) and occurs
  1057. only once per IP (no risk of an address getting rewritten a second time).
  1058. \layout Subsection*
  1059. Advanced pseudo-NAT
  1060. \layout Standard
  1061. Pseudo-NAT also works with traffic splitting (using two interfaces or output
  1062. files) but with a few important differences.
  1063. First you have the option of specifying one or two pseudo-NAT tables.
  1064. Using a single pseudo-NAT table means that the source and destination IP
  1065. addresses of both interfaces are rewritten using the same rules.
  1066. Using two pseudo-NAT tables (specifying -N <Table1> -N <Table2>) will cause
  1067. the source and destination IP addresses to be rewritten differently for
  1068. each interface using the following matrix:
  1069. \layout Standard
  1070. \align center
  1071. \begin_inset Tabular
  1072. <lyxtabular version="3" rows="3" columns="3">
  1073. <features>
  1074. <column alignment="center" valignment="top" width="0sp">
  1075. <column alignment="center" valignment="top" leftline="true" width="0sp">
  1076. <column alignment="center" valignment="top" leftline="true" rightline="true" width="0sp">
  1077. <row>
  1078. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1079. \begin_inset Text
  1080. \layout Standard
  1081. \end_inset
  1082. </cell>
  1083. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1084. \begin_inset Text
  1085. \layout Standard
  1086. Out Primary Interface
  1087. \end_inset
  1088. </cell>
  1089. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1090. \begin_inset Text
  1091. \layout Standard
  1092. Out Secondary Interface
  1093. \end_inset
  1094. </cell>
  1095. </row>
  1096. <row topline="true">
  1097. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1098. \begin_inset Text
  1099. \layout Standard
  1100. Src IP
  1101. \end_inset
  1102. </cell>
  1103. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1104. \begin_inset Text
  1105. \layout Standard
  1106. Table 1
  1107. \end_inset
  1108. </cell>
  1109. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1110. \begin_inset Text
  1111. \layout Standard
  1112. Table 2
  1113. \end_inset
  1114. </cell>
  1115. </row>
  1116. <row topline="true" bottomline="true">
  1117. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1118. \begin_inset Text
  1119. \layout Standard
  1120. Dest IP
  1121. \end_inset
  1122. </cell>
  1123. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1124. \begin_inset Text
  1125. \layout Standard
  1126. Table 2
  1127. \end_inset
  1128. </cell>
  1129. <cell alignment="center" valignment="top" topline="true" leftline="true" usebox="none">
  1130. \begin_inset Text
  1131. \layout Standard
  1132. Table 1
  1133. \end_inset
  1134. </cell>
  1135. </row>
  1136. </lyxtabular>
  1137. \end_inset
  1138. \layout Standard
  1139. While seemingly a bit confusing, this feature provides a number of interesting
  1140. possibilities such as the ability to rewrite the IP headers of packets
  1141. in the case where traffic is captured on the loopback interface (and the
  1142. source and destination address is always so that tcpreplay can
  1143. make it look like two different systems are talking to each other (you'll
  1144. probably also need to specify the source and destination MAC addresses
  1145. via -I, -J, -k and -K).
  1146. \layout Subsection*
  1147. IP Endpoints
  1148. \layout Standard
  1149. While pseudo-NAT provides a great deal of flexibility, it is often more
  1150. complicated then is necessary for testing of inline devices.
  1151. As a simplier alternative, tcpreplay supports the concept of rewriting
  1152. all traffic to so that it appears to be between two IP addresses:
  1153. \layout LyX-Code
  1154. tcpreplay --intf1=eth0 --intf2=eth1 -c sample.cache -e sample.pcap
  1155. \layout Standard
  1156. Will rewrite all the traffic so that it is between and
  1157. The equivalent command using -N would be:
  1158. \layout LyX-Code
  1159. tcpreplay --intf1=eth0 --intf2=eth1 -c sample.cache -N -N
  1160. 1.1 sample.pcap
  1161. \layout Subsection*
  1162. Unifying Dual-Outputs
  1163. \layout Standard
  1164. Since a number of tcpreplay's packet editing functions require splitting
  1165. traffic between client and servers, one problem that may arrise is needing
  1166. to edit packets but still output to a single interface or file.
  1167. The solution to this is to use the one output option -O which causes packets
  1168. to be processed as if they will be split between the interfaces/files,
  1169. but then always go out the primary interface or file.
  1170. Note that even though only one interface/file will be written to, both
  1171. -i and -j must be specified; although they can be the same physical interface.
  1172. \layout LyX-Code
  1173. tcpreplay --intf1=eth0 -j eth0 -O -c sample.cache -e sample.pcap
  1174. \layout Standard
  1175. Merging the output to a single file:
  1176. \layout LyX-Code
  1177. tcpreplay --intf1=eth0 -j eth0 -w rewrite.pcap -c sample.cache -e
  1178. sample.pcap
  1179. \layout Section*
  1180. Tcpprep Usage
  1181. \layout Subsection*
  1182. What is tcpprep?
  1183. \layout Standard
  1184. Tcpreplay can send traffic out two network cards, however it requires the
  1185. calculations be done in real-time.
  1186. These calculations can be expensive and can significantly reduce the throughput
  1187. of tcpreplay.
  1188. \layout Standard
  1189. Tcpprep is a libpcap pre-processor for tcpreplay which enables using two
  1190. network cards to send traffic without the performance hit of doing the
  1191. calculations in real-time.
  1192. \layout Subsection*
  1193. What are these 'modes' tcpprep has?
  1194. \layout Standard
  1195. Tcpprep has three basic modes which require the user to specify how to split
  1196. traffic.
  1197. \layout Itemize
  1198. CIDR (-\SpecialChar \textcompwordmark{}
  1199. -cidr) mode requires the user to provide a list of networks.
  1200. Any packet with a source IP in one of these networks gets sent out the
  1201. primary interface.
  1202. \layout Itemize
  1203. Regex (-\SpecialChar \textcompwordmark{}
  1204. -regex) mode requires the user to provide a regular expression.
  1205. Any packet with a source IP matching the regex gets sent out the primary
  1206. interface.
  1207. \layout Itemize
  1208. Port (-\SpecialChar \textcompwordmark{}
  1209. -port) mode splits TCP/UDP traffic based on the destination port
  1210. in the header.
  1211. Normally, ports 0-1023 are considered
  1212. \begin_inset Quotes eld
  1213. \end_inset
  1214. server
  1215. \begin_inset Quotes erd
  1216. \end_inset
  1217. ports and everything else a client port.
  1218. You can create your own custom mapping file in the same format as /etc/services
  1219. (see the services(5) man page for details) by specifying -\SpecialChar \textcompwordmark{}
  1220. -services <file>.
  1221. \layout Standard
  1222. And four auto modes in which tcpprep decides how to split traffic.
  1223. Auto modes are useful for when you don't know much about the contents of
  1224. the dump file in question and you want to split traffic up based upon servers
  1225. and clients.
  1226. \layout Itemize
  1227. Auto/Router (-\SpecialChar \textcompwordmark{}
  1228. -auto router) mode trys to find the largest network(s) that
  1229. contain all the servers and no clients.
  1230. Any unknown system is automatically re-classified as servers if it's inside
  1231. the server network(s), otherwise it is classified as a client.
  1232. \layout Itemize
  1233. Auto/Bridge (-\SpecialChar \textcompwordmark{}
  1234. -auto bridge) mode makes the assumption that the clients and
  1235. servers are horribly intermixed on the network and there's no way to subnet
  1236. them.
  1237. While this takes less processing time to create the cache file it is unable
  1238. to deal with unknown systems.
  1239. \layout Itemize
  1240. Auto/Client (-\SpecialChar \textcompwordmark{}
  1241. -auto client) mode which works just like Auto/Bridge mode,
  1242. except that any system it can't figure out is treated like a client.
  1243. \layout Itemize
  1244. Auto/Server (-\SpecialChar \textcompwordmark{}
  1245. -auto server) mode which works just like Auto/Bridge mode,
  1246. except that any system it can't figure out is treated like a server.
  1247. \layout Subsection*
  1248. Splitting traffic based upon IP address
  1249. \layout Standard
  1250. Tcpprep supports the same CIDR mode that tcpreplay supports using the -\SpecialChar \textcompwordmark{}
  1251. -cidr
  1252. flag.
  1253. Additionally, tcpprep also supports regex(7) regular expressions to match
  1254. source IP addresses using the -\SpecialChar \textcompwordmark{}
  1255. -regex flag.
  1256. \layout Subsection*
  1257. Auto Mode
  1258. \layout Subsubsection*
  1259. How does Auto/Bridge mode work?
  1260. \layout Standard
  1261. Tcpprep does an initial pass over the libpcap file to build a binary tree
  1262. (one node per IP).
  1263. For each IP, it keeps track of how many times it was a client or server.
  1264. It then does a second pass of the file using the data in the tree and the
  1265. ratio to determine if an IP is a client or server.
  1266. If tcpprep is unable to determine the type (client or server) for each
  1267. and every packet, then auto/bridge mode will fail.
  1268. In these cases, it is best to use a different auto mode.
  1269. \layout Subsubsection*
  1270. How does Auto/Router mode work?
  1271. \layout Standard
  1272. Tcpprep does the same first pass as Auto/Bridge mode.
  1273. It then trys to convert the binary tree into a list of networks containing
  1274. the servers.
  1275. Finally it uses the CIDR mode with the list of server networks in a second
  1276. pass of the libpcap file.
  1277. Unlike auto/bridge mode, auto/router mode can always successfully split
  1278. IP addresses into clients and servers.
  1279. \layout Subsubsection*
  1280. Determining Clients and Servers
  1281. \layout Standard
  1282. Tcpprep uses the following methods in auto/router and auto/bridge mode to
  1283. determine if an IP address is a client or server:
  1284. \layout Itemize
  1285. Client:
  1286. \begin_deeper
  1287. \layout Itemize
  1288. TCP with Syn flag set
  1289. \layout Itemize
  1290. UDP source/destination port 53 (DNS) without query flag set
  1291. \layout Itemize
  1292. ICMP port unreachable (destination IP of packet)
  1293. \end_deeper
  1294. \layout Itemize
  1295. Server:
  1296. \begin_deeper
  1297. \layout Itemize
  1298. TCP with Syn/Ack flag set
  1299. \layout Itemize
  1300. UDP source/destination port 53 (DNS) with query flag set
  1301. \layout Itemize
  1302. ICMP port unreachable (source IP of packet)
  1303. \end_deeper
  1304. \layout Subsubsection*
  1305. Client/Server ratio
  1306. \layout Standard
  1307. Since a system may send traffic which would classify it as both a client
  1308. and server, it's necessary to be able to weigh the traffic.
  1309. This is done by specifying the client/server ratio (-R) which is by default
  1310. set to 2.0.
  1311. The ratio is the modifier to the number of client connections.
  1312. Hence, by default, client connections are valued twice as high as server
  1313. connections.
  1314. \layout Subsection*
  1315. Selectively sending/dropping packets
  1316. \layout Standard
  1317. Tcpprep supports the same -\SpecialChar \textcompwordmark{}
  1318. -include and -\SpecialChar \textcompwordmark{}
  1319. -exclude options to selectively
  1320. send or drop packets.
  1321. \layout Subsection*
  1322. Using tcpprep cache files with tcpreplay
  1323. \layout Standard
  1324. Just run:
  1325. \layout LyX-Code
  1326. tcpreplay --cachefile sample.cache --intf1=eth0 --intf2=eth1 sample.pcap
  1327. \layout Subsection*
  1328. Commenting tcpprep cache files
  1329. \layout Standard
  1330. In versions of tcpprep >= 2.1.0, you can specify a comment to be embeded in
  1331. the tcpprep cache file.
  1332. Comments are user specified and automatically include the command line
  1333. arguments passed to tcpprep.
  1334. \layout LyX-Code
  1335. tcpprep --comment
  1336. \begin_inset Quotes eld
  1337. \end_inset
  1338. this is my comment
  1339. \begin_inset Quotes erd
  1340. \end_inset
  1341. --pcap sample.pcap --cachefile sample.cache <other args>
  1342. \layout Standard
  1343. Or for no user comment, but still embed the command arguments:
  1344. \layout LyX-Code
  1345. tcpprep --comment
  1346. \begin_inset Quotes eld
  1347. \end_inset
  1348. \begin_inset Quotes erd
  1349. \end_inset
  1350. --pcap sample.pcap --cachefile sample.cache <other args>
  1351. \layout Standard
  1352. You can then later on print out the comments by running:
  1353. \layout LyX-Code
  1354. tcpprep --print-comment sample.cache
  1355. \layout Section*
  1356. Using Configuration Files
  1357. \layout Standard
  1358. Each of the applications in the tcpreplay suite offers the choice of specifying
  1359. configuration options in a config file in addition to the traditional command
  1360. line.
  1361. Each command line option has an equivalent config file option which is
  1362. listed in the man page.
  1363. To specify the configuration file you'd like to use, use the -\SpecialChar \textcompwordmark{}
  1364. -load-opts=<filen
  1365. ame> option.
  1366. \layout Standard
  1367. Configuration files have one option per line, and lines beginning with the
  1368. pound sign (#) are considered comments and ignored.
  1369. An example config file follows:
  1370. \layout Standard
  1371. ------------BEGIN CONFIG FILE--------------
  1372. \layout Standard
  1373. \family typewriter
  1374. # send traffic out 'eth0'
  1375. \newline
  1376. intf1 eth0
  1377. \newline
  1378. \newline
  1379. # loop 5 times
  1380. \newline
  1381. loop 5
  1382. \newline
  1383. \newline
  1384. # send traffic 2x as fast
  1385. \newline
  1386. multiplier 2
  1387. \family default
  1388. \newline
  1389. --------------END CONFIG FILE---------------
  1390. \layout Standard
  1391. You would then execute:
  1392. \layout LyX-Code
  1393. # tcpreplay --load-opts=myconfigfile sample.pcap
  1394. \layout Standard
  1395. You can also group configuration options for tcpprep, tcprewrite and tcpreplay
  1396. in a single config file by placing section markers in the config file.
  1397. An example:
  1398. \layout Standard
  1399. ------------BEGIN CONFIG FILE--------------
  1400. \layout Standard
  1401. \family typewriter
  1402. cachefile=example.tcpprep
  1403. \newline
  1404. \newline
  1405. [TCPREPLAY]
  1406. \newline
  1407. intf1 eth0
  1408. \newline
  1409. intf2 eth1
  1410. \newline
  1411. topspeed
  1412. \newline
  1413. \newline
  1414. [TCPPREP]
  1415. \newline
  1416. auto=bridge
  1417. \newline
  1418. comment='This cache file was created with a config file'
  1419. \newline
  1420. pcap=sample.pcap
  1421. \newline
  1422. \newline
  1423. [TCPREWRITE]
  1424. \newline
  1425. infile=sample.pcap
  1426. \newline
  1427. outfile=newsample.pcap
  1428. \newline
  1429. vlan=add
  1430. \newline
  1431. vlan-tag=44
  1432. \newline
  1433. endpoints=
  1434. \layout Standard
  1435. ------------END CONFIG FILE--------------
  1436. \layout Section*
  1437. Flowreplay Usage
  1438. \layout Standard
  1439. While tcpreplay is a great way to test NIDS and firewalls, it can't be used
  1440. to test servers or HIDS since tcpreplay can't connect to a service running
  1441. on a device.
  1442. The solution to this problem is flowreplay which instead of sending packets
  1443. at Layer 2 (ethernet header and up), it can actually connect via TCP or
  1444. UDP to server and then sends and receives data based upon a pcap capture
  1445. file created with a tool like Ethereal or tcpdump.
  1446. \layout Standard
  1447. Please note that flowreplay is currently alpha quality and is missing a
  1448. number of key features.
  1449. \layout Subsection*
  1450. How flowreplay works
  1451. \layout Standard
  1452. Put simply, flowreplay opens a socket connection to a service on a target
  1453. system(s) and sends data over that socket based on the packet capture.
  1454. Flowreplay has no understanding of the application protocol (like HTTP
  1455. or FTP) so it is somewhat limited in how it can deal with complicated exchanges
  1456. between client and server.
  1457. \layout Standard
  1458. Some of these limitations are:
  1459. \layout Itemize
  1460. Flowreplay only plays the client side
  1461. \begin_inset Foot
  1462. collapsed false
  1463. \layout Standard
  1464. Flowreplay assumes the first UDP packet on a given 4-tuple is the client
  1465. \end_inset
  1466. of the connection.
  1467. \layout Itemize
  1468. Flowreplay doesn't understand the application protocols.
  1469. Hence it can't always deal with the case when the server sends a different
  1470. response then what was originally captured in the pcap file.
  1471. \layout Itemize
  1472. Flowreplay only sends TCP and UDP traffic.
  1473. \layout Itemize
  1474. Flowreplay doesn't know about multi-flow protocols like FTP.
  1475. \layout Itemize
  1476. Flowreplay can't listen on a port and wait for a client to connect to it.
  1477. \layout Subsection*
  1478. Running flowreplay
  1479. \layout Standard
  1480. See the flowreplay(8) man page for details.
  1481. \layout Section*
  1482. Tuning OS's for high performance
  1483. \layout Standard
  1484. Regardless of the size of physical memory, UNIX kernels will only allocate
  1485. a static amount for network buffers.
  1486. This includes packets sent via the "raw" interface, like with tcpreplay.
  1487. Most kernels will allow you to tweak the size of these buffers, drastically
  1488. increasing performance and accuracy.
  1489. \layout Standard
  1490. N
  1491. \noun on
  1492. ote:
  1493. \noun default
  1494. The following information is provided based upon our own experiences or
  1495. the reported experiences of others.
  1496. Depending on your hardware and specific hardware, it may or may not work
  1497. for you.
  1498. It may even make your system horribly unstable, corrupt your harddrive,
  1499. or worse.
  1500. \layout Standard
  1501. \noun on
  1502. Note
  1503. \noun default
  1504. : Different operating systems, network card drivers, and even hardware can
  1505. have an effect on the accuracy of packet timestamps that tcpdump or other
  1506. capture utilities generate.
  1507. And as you know: garbage in, garbage out.
  1508. \layout Standard
  1509. \noun on
  1510. Note:
  1511. \noun default
  1512. If you have information on tuning the kernel of an operating system not
  1513. listed here, please send it to me so I can include it.
  1514. \layout Subsection*
  1515. Linux 2.4.x
  1516. \layout Standard
  1517. The following is known to apply to the 2.4.x series of kernels.
  1518. If anyone has any information regarding other kernel versions, please let
  1519. us know.
  1520. By default Linux's tcpreplay performance isn't all that stellar.
  1521. However, with a simple tweak, relatively decent performance can be had
  1522. on the right hardware.
  1523. By default, Linux specifies a 64K buffer for sending packets.
  1524. Increasing this buffer to about half a megabyte does a good job:
  1525. \layout Standard
  1526. \emph on
  1527. echo 524287 >/proc/sys/net/core/wmem_default
  1528. \newline
  1529. echo 524287 >/proc/sys/net/core/wmem_max
  1530. \newline
  1531. echo 524287 >/proc/sys/net/core/rmem_max
  1532. \newline
  1533. echo 524287 >/proc/sys/net/core/rmem_default
  1534. \layout Standard
  1535. On one system, we've seen a jump from 23.02 megabits/sec (5560 packets/sec)
  1536. to 220.30 megabits/sec (53212 packets/sec) which is nearly a 10x increase
  1537. in performance.
  1538. Depending on your system and capture file, different numbers may provide
  1539. different results.
  1540. \layout Subsection*
  1541. *BSD
  1542. \layout Standard
  1543. *BSD systems typically allow you to specify the size of network buffers
  1544. with the NMBCLUSTERS option in the kernel config file.
  1545. Experiment with different sizes to see which yields the best performance.
  1546. See the options(4) man page for more details.
  1547. \layout Section*
  1548. Required Libraries and Tools
  1549. \layout Subsection*
  1550. Libpcap
  1551. \layout Standard
  1552. As of tcpreplay v1.4, you'll need to have libpcap installed on your system.
  1553. As of v2.0, you'll need at least version 0.6.0 or better, but I only test
  1554. our code with the latest version.
  1555. Libpcap can be obtained on the tcpdump homepage
  1556. \begin_inset Foot
  1557. collapsed true
  1558. \layout Standard
  1559. \begin_inset LatexCommand \htmlurl{}
  1560. \end_inset
  1561. \end_inset
  1562. .
  1563. \layout Subsection*
  1564. Libnet
  1565. \layout Standard
  1566. Tcpreplay v1.3 is the last version to support the old libnet API (everything
  1567. before 1.1.x).
  1568. As of v1.4 you will need to use Libnet 1.1.0 or better which can be obtained
  1569. from the Libnet homepage
  1570. \begin_inset Foot
  1571. collapsed true
  1572. \layout Standard
  1573. \begin_inset LatexCommand \htmlurl{}
  1574. \end_inset
  1575. \end_inset
  1576. .
  1577. \layout Subsection*
  1578. Tcpdump
  1579. \layout Standard
  1580. As of 2.0, tcpreplay uses tcpdump (the binary, not code) to decode packets
  1581. to STDOUT in a human readable (with practice) format as it sends them.
  1582. If you would like this feature, tcpdump must be installed on your system.
  1583. \layout Standard
  1584. \noun on
  1585. Note:
  1586. \noun default
  1587. The location of the tcpdump binary is hardcoded in tcpreplay at compile
  1588. time.
  1589. If tcpdump gets renamed or moved, the feature will become disabled.
  1590. \layout Part*
  1591. Other Resources
  1592. \layout Section*
  1593. Other pcap tools available
  1594. \layout Subsection*
  1595. Tools to capture network traffic or decode pcap files
  1596. \layout Itemize
  1597. tcpdump
  1598. \newline
  1599. \begin_inset LatexCommand \htmlurl{}
  1600. \end_inset
  1601. \layout Itemize
  1602. ethereal
  1603. \newline
  1604. \begin_inset LatexCommand \htmlurl{}
  1605. \end_inset
  1606. \layout Itemize
  1607. ettercap
  1608. \newline
  1609. \begin_inset LatexCommand \htmlurl{}
  1610. \end_inset
  1611. \layout Subsection*
  1612. Tools to edit pcap files
  1613. \layout Itemize
  1614. tcpslice
  1615. \newline
  1616. Splits pcap files into smaller files
  1617. \newline
  1618. \begin_inset LatexCommand \htmlurl{}
  1619. \end_inset
  1620. \layout Itemize
  1621. mergecap
  1622. \newline
  1623. Merges two pcap capture files into one
  1624. \newline
  1625. \begin_inset LatexCommand \htmlurl{}
  1626. \end_inset
  1627. \layout Itemize
  1628. editcap
  1629. \newline
  1630. Converts capture file formats (pcap, snoop, etc)
  1631. \newline
  1632. \begin_inset LatexCommand \htmlurl{}
  1633. \end_inset
  1634. \layout Itemize
  1635. netdude
  1636. \newline
  1637. GTK based pcap capture file editor.
  1638. Allows editing most anything in the packet.
  1639. \newline
  1640. \begin_inset LatexCommand \htmlurl{}
  1641. \end_inset
  1642. \layout Subsection*
  1643. Other useful tools
  1644. \layout Itemize
  1645. capinfo
  1646. \newline
  1647. Prints statistics and basic information about a pcap file
  1648. \newline
  1649. \begin_inset LatexCommand \htmlurl{}
  1650. \end_inset
  1651. \layout Itemize
  1652. text2pcap
  1653. \newline
  1654. Generates a pcap capture file from a hex dump
  1655. \newline
  1656. \begin_inset LatexCommand \htmlurl{}
  1657. \end_inset
  1658. \layout Itemize
  1659. tcpflow
  1660. \newline
  1661. Extracts and reassembles the data portion on a per-flow basis on live traffic
  1662. or pcap capture files
  1663. \newline
  1664. \begin_inset LatexCommand \htmlurl{}
  1665. \end_inset
  1666. \the_end