tcpprep.1 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448
  1. .de1 NOP
  2. . it 1 an-trap
  3. . if \\n[.$] \,\\$*\/
  4. ..
  5. .ie t \
  6. .ds B-Font [CB]
  7. .ds I-Font [CI]
  8. .ds R-Font [CR]
  9. .el \
  10. .ds B-Font B
  11. .ds I-Font I
  12. .ds R-Font R
  13. .TH tcpprep 1 "14 Jun 2020" "tcpprep" "User Commands"
  14. .\"
  15. .\" DO NOT EDIT THIS FILE (in-mem file)
  16. .\"
  17. .\" It has been AutoGen-ed
  18. .\" From the definitions tcpprep_opts.def
  19. .\" and the template file agman-cmd.tpl
  20. .SH NAME
  21. \f\*[B-Font]tcpprep\fP
  22. \- Create a tcpreplay cache cache file from a pcap file.
  23. .SH SYNOPSIS
  24. \f\*[B-Font]tcpprep\fP
  25. .\" Mixture of short (flag) options and long options
  26. [\f\*[B-Font]\-flags\f[]]
  27. [\f\*[B-Font]\-flag\f[] [\f\*[I-Font]value\f[]]]
  28. [\f\*[B-Font]\-\-option-name\f[][[=| ]\f\*[I-Font]value\f[]]]
  29. .sp \n(Ppu
  30. .ne 2
  31. All arguments must be options.
  32. .sp \n(Ppu
  33. .ne 2
  34. tcpprep is a \fIpcap(3)\fP file pre-processor which creates a cache
  35. file which provides "rules" for \fItcprewrite(1)\fP and \fItcpreplay(1)\fP
  36. on how to process and send packets.
  37. .SH "DESCRIPTION"
  38. The basic operation of tcpreplay is to resend all packets from the
  39. input file(s) out a single file. Tcpprep processes a pcap file and
  40. applies a set of user-specified rules to create a cache file which
  41. tells tcpreplay whether or not to send each packet and which interface the
  42. packet should be sent out of.
  43. .sp
  44. For more details, please see the Tcpreplay Manual at:
  45. http://tcpreplay.appneta.com
  46. .SH "OPTIONS"
  47. .TP
  48. .NOP \f\*[B-Font]\-d\f[] \f\*[I-Font]number\f[], \f\*[B-Font]\-\-dbug\f[]=\f\*[I-Font]number\f[]
  49. Enable debugging output.
  50. This option may appear up to 1 times.
  51. This option takes an integer number as its argument.
  52. The value of
  53. \f\*[I-Font]number\f[]
  54. is constrained to being:
  55. .in +4
  56. .nf
  57. .na
  58. in the range 0 through 5
  59. .fi
  60. .in -4
  61. The default
  62. \f\*[I-Font]number\f[]
  63. for this option is:
  64. .ti +4
  65. 0
  66. .sp
  67. If configured with \--enable-debug, then you can specify a verbosity
  68. level for debugging output. Higher numbers increase verbosity.
  69. .TP
  70. .NOP \f\*[B-Font]\-a\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-auto\f[]=\f\*[I-Font]string\f[]
  71. Auto-split mode.
  72. This option may appear up to 1 times.
  73. This option must not appear in combination with any of the following options:
  74. cidr, port, regex, mac.
  75. .sp
  76. Tcpprep will try to automatically determine the primary function of hosts
  77. based on the traffic captured and classify each host as client or server.
  78. In order to do so, you must provide a hint to tcpprep as to how to search
  79. for clients and servers. Valid hints are:
  80. .sp
  81. .sp 1
  82. \fBbridge\fP
  83. Bridge mode processes each packet to try to determine if the sender is a
  84. client or server. Once all the packets are processed, the results are weighed
  85. according to the server/client ratio (\fB--ratio\fP) and systems are assigned an
  86. interface. If tcpprep is unable to determine what role a system plays, tcpprep
  87. will abort.
  88. .sp 1
  89. \fBrouter\fP
  90. Router mode works just like bridge mode, except that after weighing is done,
  91. systems which are undetermined are considered a server if they fall inside a
  92. network known to contain other servers. Router has a greater chance of
  93. successfully splitting clients and servers but is not 100% foolproof.
  94. .sp 1
  95. \fBclient\fP
  96. Client mode works just like bridge mode, except that unclassified systems are
  97. treated as clients. Client mode should always complete successfully.
  98. .sp 1
  99. \fBserver\fP
  100. Server mode works just like bridge mode, except that unclassified systems are
  101. treated as servers. Server mode should always complete successfully.
  102. .sp 1
  103. \fBfirst\fP
  104. First mode works by looking at the first time each IP is seen in the SRC and DST
  105. fields in the IP header. If the host is first seen in the SRC field, it is a
  106. client and if it's first seen in the DST field, it is marked as a server. This
  107. effectively replicates the processing of the tomahawk test tool. First
  108. mode should always complete successfully.
  109. .br
  110. .TP
  111. .NOP \f\*[B-Font]\-c\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-cidr\f[]=\f\*[I-Font]string\f[]
  112. CIDR-split mode.
  113. This option may appear up to 1 times.
  114. This option must not appear in combination with any of the following options:
  115. auto, port, regex, mac.
  116. .sp
  117. Specify a comma delimited list of CIDR netblocks to match against
  118. the source IP of each packet. Packets matching any of the CIDR's
  119. are classified as servers.
  120. .sp
  121. IPv4 Example:
  122. .nf
  123. \--cidr=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
  124. .fi
  125. IPv6 Example:
  126. .nf
  127. \--cidr=[::ffff:0:0/96],[fe80::/16]
  128. .fi
  129. .TP
  130. .NOP \f\*[B-Font]\-r\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-regex\f[]=\f\*[I-Font]string\f[]
  131. Regex-split mode.
  132. This option may appear up to 1 times.
  133. This option must not appear in combination with any of the following options:
  134. auto, port, cidr, mac.
  135. .sp
  136. Specify a regular expression to match against the source IP of each
  137. packet. Packets matching the regex are classified as servers.
  138. .TP
  139. .NOP \f\*[B-Font]\-p\f[], \f\*[B-Font]\-\-port\f[]
  140. Port-split mode.
  141. This option may appear up to 1 times.
  142. This option must not appear in combination with any of the following options:
  143. auto, regex, cidr, mac.
  144. .sp
  145. Specifies that TCP and UDP traffic over IPv4 and IPv6 should be classified
  146. as client or server based upon the destination port of the header.
  147. .TP
  148. .NOP \f\*[B-Font]\-e\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-mac\f[]=\f\*[I-Font]string\f[]
  149. Source MAC split mode.
  150. This option may appear up to 1 times.
  151. This option must not appear in combination with any of the following options:
  152. auto, regex, cidr, port.
  153. .sp
  154. Specify a list of MAC addresses to match against the source MAC
  155. of each packet. Packets matching one of the values are classified
  156. as servers.
  157. .TP
  158. .NOP \f\*[B-Font]\-\-reverse\f[]
  159. Matches to be client instead of server.
  160. This option may appear up to 1 times.
  161. .sp
  162. Normally the \fB--mac\fP, \fB--regex\fP and \fB--cidr\fP flags specify are used to specify
  163. the servers and non-IP packets are classified as clients. By using \fB--reverse\fP, these
  164. features are reversed so that the flags specify clients and non-IP packets are classified as
  165. servers.
  166. .TP
  167. .NOP \f\*[B-Font]\-C\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-comment\f[]=\f\*[I-Font]string\f[]
  168. Embedded cache file comment.
  169. This option may appear up to 1 times.
  170. .sp
  171. Specify a comment to be imbedded within the output cache file and later
  172. viewed.
  173. .TP
  174. .NOP \f\*[B-Font]\-\-no\-arg\-comment\f[]
  175. Do not embed any cache file comment.
  176. This option may appear up to 1 times.
  177. .sp
  178. By default, tcpprep includes the arguments passed on the command line
  179. in the cache file comment (in addition to any user specified \--comment).
  180. If for some reason you do not wish to include this, specify this option.
  181. .TP
  182. .NOP \f\*[B-Font]\-x\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-include\f[]=\f\*[I-Font]string\f[]
  183. Include only packets matching rule.
  184. This option may appear up to 1 times.
  185. This option must not appear in combination with any of the following options:
  186. exclude.
  187. .sp
  188. Override default of processing all packets stored in the capture file and only
  189. send/edit packets which match the provided rule. Rules can be one of:
  190. .sp
  191. .sp
  192. .IR "S:<CIDR1>,..."
  193. - Source IP must match specified IPv4/v6 CIDR(s)
  194. .sp
  195. .IR "D:<CIDR1>,..."
  196. - Destination IP must match specified IPv4/v6 CIDR(s)
  197. .sp
  198. .IR "B:<CIDR1>,..."
  199. - Both source and destination IP must match specified IPv4/v6 CIDR(s)
  200. .sp
  201. .IR "E:<CIDR1>,..."
  202. - Either IP must match specified IPv4/v6 CIDR(s)
  203. .sp
  204. .IR "P:<LIST>"
  205. - Must be one of the listed packets where the list
  206. corresponds to the packet number in the capture file.
  207. .nf
  208. \-x P:1-5,9,15,72-
  209. .fi
  210. would process packets 1 through 5, the 9th and 15th packet, and packets 72 until the
  211. end of the file
  212. .sp
  213. .IR "F:'<bpf>'"
  214. - BPF filter. See the \fItcpdump(8)\fP man page for syntax.
  215. .br
  216. .TP
  217. .NOP \f\*[B-Font]\-X\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-exclude\f[]=\f\*[I-Font]string\f[]
  218. Exclude any packet matching this rule.
  219. This option may appear up to 1 times.
  220. This option must not appear in combination with any of the following options:
  221. include.
  222. .sp
  223. Override default of processing all packets stored in the capture file and only
  224. send/edit packets which do NOT match the provided rule. Rules can be one of:
  225. .sp
  226. .sp
  227. .IR "S:<CIDR1>,..."
  228. - Source IP must not match specified IPv4/v6 CIDR(s)
  229. .sp
  230. .IR "D:<CIDR1>,..."
  231. - Destination IP must not match specified IPv4/v6 CIDR(s)
  232. .sp
  233. .IR "B:<CIDR1>,..."
  234. - Both source and destination IP must not match specified IPv4/v6 CIDR(s)
  235. .sp
  236. .IR "E:<CIDR1>,..."
  237. - Either IP must not match specified IPv4/v6 CIDR(s)
  238. .sp
  239. .IR "P:<LIST>"
  240. - Must not be one of the listed packets where the list
  241. corresponds to the packet number in the capture file.
  242. .nf
  243. \-x P:1-5,9,15,72-
  244. .fi
  245. would skip packets 1 through 5, the 9th and 15th packet, and packets 72 until the
  246. end of the file
  247. .br
  248. .TP
  249. .NOP \f\*[B-Font]\-o\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-cachefile\f[]=\f\*[I-Font]string\f[]
  250. Output cache file.
  251. This option may appear up to 1 times.
  252. .sp
  253. .TP
  254. .NOP \f\*[B-Font]\-i\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-pcap\f[]=\f\*[I-Font]string\f[]
  255. Input pcap file to process.
  256. This option may appear up to 1 times.
  257. .sp
  258. .TP
  259. .NOP \f\*[B-Font]\-P\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-print\-comment\f[]=\f\*[I-Font]string\f[]
  260. Print embedded comment in the specified cache file.
  261. This option may appear up to 1 times.
  262. .sp
  263. .TP
  264. .NOP \f\*[B-Font]\-I\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-print\-info\f[]=\f\*[I-Font]string\f[]
  265. Print basic info from the specified cache file.
  266. This option may appear up to 1 times.
  267. .sp
  268. .TP
  269. .NOP \f\*[B-Font]\-S\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-print\-stats\f[]=\f\*[I-Font]string\f[]
  270. Print statistical information about the specified cache file.
  271. This option may appear up to 1 times.
  272. .sp
  273. .TP
  274. .NOP \f\*[B-Font]\-s\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-services\f[]=\f\*[I-Font]string\f[]
  275. Load services file for server ports.
  276. This option may appear up to 1 times.
  277. This option must appear in combination with the following options:
  278. port.
  279. .sp
  280. Uses a list of ports used by servers in the same format as of /etc/services:
  281. <service_name> <port>/<protocol> # comment
  282. .sp
  283. Example:
  284. http 80/tcp
  285. .TP
  286. .NOP \f\*[B-Font]\-N\f[], \f\*[B-Font]\-\-nonip\f[]
  287. Send non-IP traffic out server interface.
  288. This option may appear up to 1 times.
  289. .sp
  290. By default, non-IP traffic which can not be classified as client
  291. or server is classified as "client". Specifying \fB--nonip\fP
  292. will reclassify non-IP traffic as "server". Note that the meaning
  293. of this flag is reversed if \fB--reverse\fP is used.
  294. .TP
  295. .NOP \f\*[B-Font]\-R\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-ratio\f[]=\f\*[I-Font]string\f[]
  296. Ratio of client to server packets.
  297. This option may appear up to 1 times.
  298. This option must appear in combination with the following options:
  299. auto.
  300. The default
  301. \f\*[I-Font]string\f[]
  302. for this option is:
  303. .ti +4
  304. 2.0
  305. .sp
  306. Since a given host may have both client and server traffic being sent
  307. to/from it, tcpprep uses a ratio to weigh these packets. If you would
  308. like to override the default of 2:1 server to client packets required for
  309. a host to be classified as a server, specify it as a floating point value.
  310. .TP
  311. .NOP \f\*[B-Font]\-m\f[] \f\*[I-Font]number\f[], \f\*[B-Font]\-\-minmask\f[]=\f\*[I-Font]number\f[]
  312. Minimum network mask length in auto mode.
  313. This option may appear up to 1 times.
  314. This option must appear in combination with the following options:
  315. auto.
  316. This option takes an integer number as its argument.
  317. The value of
  318. \f\*[I-Font]number\f[]
  319. is constrained to being:
  320. .in +4
  321. .nf
  322. .na
  323. in the range 0 through 32
  324. .fi
  325. .in -4
  326. The default
  327. \f\*[I-Font]number\f[]
  328. for this option is:
  329. .ti +4
  330. 30
  331. .sp
  332. By default, auto modes use a minimum network mask length of 30 bits
  333. to build networks containing clients and servers. This allows you
  334. to override this value. Larger values will increase performance but
  335. may provide inaccurate results.
  336. .TP
  337. .NOP \f\*[B-Font]\-M\f[] \f\*[I-Font]number\f[], \f\*[B-Font]\-\-maxmask\f[]=\f\*[I-Font]number\f[]
  338. Maximum network mask length in auto mode.
  339. This option may appear up to 1 times.
  340. This option must appear in combination with the following options:
  341. auto.
  342. This option takes an integer number as its argument.
  343. The value of
  344. \f\*[I-Font]number\f[]
  345. is constrained to being:
  346. .in +4
  347. .nf
  348. .na
  349. in the range 0 through 32
  350. .fi
  351. .in -4
  352. The default
  353. \f\*[I-Font]number\f[]
  354. for this option is:
  355. .ti +4
  356. 8
  357. .sp
  358. By default, auto modes use a maximum network mask length of 8 bits
  359. to build networks containing clients and servers. This allows you
  360. to override this value. Larger values will decrease performance
  361. and accuracy but will provide greater chance of success.
  362. .TP
  363. .NOP \f\*[B-Font]\-v\f[], \f\*[B-Font]\-\-verbose\f[]
  364. Print decoded packets via tcpdump to STDOUT.
  365. This option may appear up to 1 times.
  366. .sp
  367. .TP
  368. .NOP \f\*[B-Font]\-A\f[] \f\*[I-Font]string\f[], \f\*[B-Font]\-\-decode\f[]=\f\*[I-Font]string\f[]
  369. Arguments passed to tcpdump decoder.
  370. This option may appear up to 1 times.
  371. This option must appear in combination with the following options:
  372. verbose.
  373. .sp
  374. When enabling verbose mode (\fB-v\fP) you may also specify one or
  375. more additional arguments to pass to \fBtcpdump\fP to modify
  376. the way packets are decoded. By default, \-n and \-l are used.
  377. Be sure to quote the arguments so that they are not interpreted
  378. by tcprewrite. The following arguments are valid:
  379. [ \-aAeNqRStuvxX ]
  380. [ \-E spi@ipaddr algo:secret,... ]
  381. [ \-s snaplen ]
  382. .TP
  383. .NOP \f\*[B-Font]\-V\f[], \f\*[B-Font]\-\-version\f[]
  384. Print version information.
  385. .sp
  386. .TP
  387. .NOP \f\*[B-Font]\-h\f[], \f\*[B-Font]\-\-less\-help\f[]
  388. Display less usage information and exit.
  389. .sp
  390. This option has not been fully documented.
  391. .TP
  392. .NOP \f\*[B-Font]\-H\f[], \f\*[B-Font]\-\-help\f[]
  393. Display usage information and exit.
  394. .TP
  395. .NOP \f\*[B-Font]\-\&!\f[], \f\*[B-Font]\-\-more-help\f[]
  396. Pass the extended usage information through a pager.
  397. .TP
  398. .NOP \f\*[B-Font]\-\-save-opts\f[] [=\f\*[I-Font]cfgfile\f[]]
  399. Save the option state to \fIcfgfile\fP. The default is the \fIlast\fP
  400. configuration file listed in the \fBOPTION PRESETS\fP section, below.
  401. The command will exit after updating the config file.
  402. .TP
  403. .NOP \f\*[B-Font]\-\-load-opts\f[]=\f\*[I-Font]cfgfile\f[], \f\*[B-Font]\-\-no-load-opts\f[]
  404. Load options from \fIcfgfile\fP.
  405. The \fIno-load-opts\fP form will disable the loading
  406. of earlier config/rc/ini files. \fI\-\-no-load-opts\fP is handled early,
  407. out of order.
  408. .PP
  409. .SH "OPTION PRESETS"
  410. Any option that is not marked as \fInot presettable\fP may be preset
  411. by loading values from configuration ("RC" or ".INI") file(s).
  412. The \fIhomerc\fP file is "\fI$$/\fP", unless that is a directory.
  413. In that case, the file "\fI.tcppreprc\fP"
  414. is searched for within that directory.
  415. .SH "FILES"
  416. See \fBOPTION PRESETS\fP for configuration files.
  417. .SH "EXIT STATUS"
  418. One of the following exit values will be returned:
  419. .TP
  420. .NOP 0 " (EXIT_SUCCESS)"
  421. Successful program execution.
  422. .TP
  423. .NOP 1 " (EXIT_FAILURE)"
  424. The operation failed or the command syntax was not valid.
  425. .TP
  426. .NOP 66 " (EX_NOINPUT)"
  427. A specified configuration file could not be loaded.
  428. .TP
  429. .NOP 70 " (EX_SOFTWARE)"
  430. libopts had an internal operational error. Please report
  431. it to autogen-users@lists.sourceforge.net. Thank you.
  432. .PP
  433. .SH "AUTHORS"
  434. Copyright 2013-2018 Fred Klassen \- AppNeta
  435. Copyright 2000-2012 Aaron Turner
  436. For support please use the tcpreplay-users@lists.sourceforge.net mailing list.
  437. The latest version of this software is always available from:
  438. http://tcpreplay.appneta.com/
  439. .SH "COPYRIGHT"
  440. Copyright (C) 2000-2018 Aaron Turner and Fred Klassen all rights reserved.
  441. This program is released under the terms of the GNU General Public License, version 3 or later.
  442. .SH "BUGS"
  443. Please send bug reports to: tcpreplay-users@lists.sourceforge.net
  444. .SH "NOTES"
  445. This manual page was \fIAutoGen\fP-erated from the \fBtcpprep\fP
  446. option definitions.