1
0

tcpprep.html 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335
  1. <!--#exec cmd="header tcpprep" -->
  2. <ul>
  3. </ul><H2>NAME </H2><ul>
  4. tcpprep - Create a tcpreplay cache cache file from a pcap file.
  5. </ul><H2>SYNOPSIS </H2><ul>
  6. <b>tcpprep</b>
  7. [<b>-<i>flag</i></b> [<i>value</i>]]... [<b>--<i>opt-name</i></b> [[=| ]<i>value</i>]]...
  8. <p>
  9. All arguments must be options.
  10. <p>
  11. tcpprep is a <i>pcap(3)</i> file pre-processor which creates a cache
  12. file which provides "rules" for <i>tcprewrite(1)</i> and <i>tcpreplay(1)</i>
  13. on how to process and send packets.
  14. </ul><H2>DESCRIPTION </H2><ul>
  15. This manual page documents, briefly, the <b>tcpprep</b> command.
  16. The basic operation of tcpreplay is to resend all packets from the
  17. input file(s) out a single file. Tcpprep processes a pcap file and
  18. applies a set of user-specified rules to create a cache file which
  19. tells tcpreplay wether or not to send each packet and which interface the
  20. packet should be sent out of.
  21. </ul><H2>OPTIONS </H2><ul>
  22. <p><dl compact><dt><b>-d</b> <i>number</i>, <b>--dbug</b>=<b><i>number</i></b>
  23. <dd>Enable debugging output.
  24. This option may appear up to 1 times.
  25. The default <i>number</i> for this option is:
  26. </dl><br>
  27. 0
  28. <p>
  29. If configured with --enable-debug, then you can specify a verbosity
  30. level for debugging output. Higher numbers increase verbosity.
  31. <p><dl compact><dt><b>-a</b> <i>string</i>, <b>--auto</b>=<b><i>string</i></b>
  32. <dd>Auto-split mode.
  33. This option may appear up to 1 times.
  34. This option must not appear in combination with any of the following options:
  35. cidr, port, regex.
  36. </dl>
  37. <p>
  38. Tcpprep will try to automatically determine the primary function of hosts
  39. based on the traffic captured and classify each host as client or server.
  40. In order to do so, you must provide a hint to tcpprep as to how to search
  41. for clients and servers. Valid hints are:
  42. <p>
  43. <p>
  44. <b>bridge</b>
  45. Bridge mode processes each packet to try to determine if the sender is a
  46. client or server. Once all the packets are processed, the results are weighed
  47. according to the server/client ratio (<b>--ratio</b>) and systems are assigned an
  48. interface. If tcpprep is unable to determine what role a system plays, tcpprep
  49. will abort.
  50. <p>
  51. <b>router</b>
  52. Router mode works just like bridge mode, except that after weighing is done,
  53. systems which are undetermined are considered a server if they fall inside a
  54. network known to contain other servers. Router has a greater chance of
  55. successfully splitting clients and servers but is not 100% foolproof.
  56. <p>
  57. <b>client</b>
  58. Client mode works just like bridge mode, except that unclassified systems are
  59. treated as clients. Client mode should always complete successfully.
  60. <p>
  61. <b>server</b>
  62. Server mode works just like bridge mode, except that unclassified systems are
  63. treated as servers. Server mode should always complete successfully.
  64. <br>
  65. <p><dl compact><dt><b>-c</b> <i>string</i>, <b>--cidr</b>=<b><i>string</i></b>
  66. <dd>CIDR-split mode.
  67. This option may appear up to 1 times.
  68. This option must not appear in combination with any of the following options:
  69. auto, port, regex.
  70. </dl>
  71. <p>
  72. Specify a comma delimited list of CIDR netblocks to match against
  73. the source IP of each packet. Packets matching any of the CIDR's
  74. are classified as servers.
  75. <p><dl compact><dt><b>-r</b> <i>string</i>, <b>--regex</b>=<b><i>string</i></b>
  76. <dd>Regex-split mode.
  77. This option may appear up to 1 times.
  78. This option must not appear in combination with any of the following options:
  79. auto, port, cidr.
  80. </dl>
  81. <p>
  82. Specify a regular expression to match against the source IP of each
  83. packet. Packets matching the regex are classified as servers.
  84. <p><dl compact><dt><b>-p</b>, <b>--port</b>
  85. <dd>Port-split mode.
  86. This option must not appear in combination with any of the following options:
  87. auto, regex, cidr.
  88. </dl>
  89. <p>
  90. Specifies that TCP and UDP traffic should be classified as client
  91. or server based upon the destination port of the header.
  92. <p><dl compact><dt><b>-C</b> <i>string</i>, <b>--comment</b>=<b><i>string</i></b>
  93. <dd>Embeded cache file comment.
  94. This option may appear up to 1 times.
  95. </dl>
  96. <p>
  97. Specify a comment to be imbedded within the output cache file and later
  98. viewed.
  99. <p><dl compact><dt><b>--no-arg-comment</b>
  100. <dd>Do not embed any cache file comment.
  101. This option may appear up to 1 times.
  102. </dl>
  103. <p>
  104. By default, tcpprep includes the arguments passed on the command line
  105. in the cache file comment (in addition to any user specified --comment).
  106. If for some reason you do not wish to include this, specify this option.
  107. <p><dl compact><dt><b>-x</b> <i>string</i>, <b>--include</b>=<b><i>string</i></b>
  108. <dd>Include only packets matching rule.
  109. This option may appear up to 1 times.
  110. This option must not appear in combination with any of the following options:
  111. exclude.
  112. </dl>
  113. <p>
  114. Override default of sending all packets stored in the capture file and only
  115. send packets which match the provided rule. Rules can be one of:
  116. <p>
  117. <p>
  118. <i>S:&lt;CIDR1&gt;,... </i>
  119. - Source IP must match specified CIDR(s)
  120. <p>
  121. <i>D:&lt;CIDR1&gt;,... </i>
  122. - Destination IP must match specified CIDR(s)
  123. <p>
  124. <i>B:&lt;CIDR1&gt;,... </i>
  125. - Both source and destination IP must match specified CIDR(s)
  126. <p>
  127. <i>E:&lt;CIDR1&gt;,... </i>
  128. - Either IP must match specified CIDR(s)
  129. <p>
  130. <i>P:&lt;LIST&gt; </i>
  131. - Must be one of the listed packets where the list
  132. corresponds to the packet number in the capture file.
  133. <pre>
  134. -x P:1-5,9,15,72-
  135. <br></pre>
  136. would send packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
  137. end of the file
  138. <p>
  139. <i>F:'&lt;bpf&gt;'</i>
  140. - BPF filter. See the <i>tcpdump(8)</i> man page for syntax.
  141. <br>
  142. <p><dl compact><dt><b>-X</b> <i>string</i>, <b>--exclude</b>=<b><i>string</i></b>
  143. <dd>Exclude any packet matching this rule.
  144. This option may appear up to 1 times.
  145. This option must not appear in combination with any of the following options:
  146. include.
  147. </dl>
  148. <p>
  149. Override default of sending all packets stored in the capture file and only
  150. send packets which do not match the provided rule. Rules can be one of:
  151. <p>
  152. <p>
  153. <i>S:&lt;CIDR1&gt;,... </i>
  154. - Source IP must not match specified CIDR(s)
  155. <p>
  156. <i>D:&lt;CIDR1&gt;,... </i>
  157. - Destination IP must not match specified CIDR(s)
  158. <p>
  159. <i>B:&lt;CIDR1&gt;,... </i>
  160. - Both source and destination IP must not match specified CIDR(s)
  161. <p>
  162. <i>E:&lt;CIDR1&gt;,... </i>
  163. - Either IP must not match specified CIDR(s)
  164. <p>
  165. <i>P:&lt;LIST&gt; </i>
  166. - Must not be one of the listed packets where the list
  167. corresponds to the packet number in the capture file.
  168. <pre>
  169. -x P:1-5,9,15,72-
  170. <br></pre>
  171. would drop packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
  172. end of the file
  173. <br>
  174. <p><dl compact><dt><b>-o</b> <i>string</i>, <b>--cachefile</b>=<b><i>string</i></b>
  175. <dd>Output cache file.
  176. This option may appear up to 1 times.
  177. </dl>
  178. <p>
  179. <p><p><dl compact><dt><b>-i</b> <i>string</i>, <b>--pcap</b>=<b><i>string</i></b>
  180. <dd>Input pcap file to process.
  181. This option may appear up to 1 times.
  182. </dl>
  183. <p>
  184. <p><p><dl compact><dt><b>-P</b> <i>string</i>, <b>--print-comment</b>=<b><i>string</i></b>
  185. <dd>Print embedded comment in the specified cache file.
  186. </dl>
  187. <p>
  188. <p><p><dl compact><dt><b>-I</b> <i>string</i>, <b>--print-info</b>=<b><i>string</i></b>
  189. <dd>Print basic info from the specified cache file.
  190. </dl>
  191. <p>
  192. <p><p><dl compact><dt><b>-s</b> <i>string</i>, <b>--services</b>=<b><i>string</i></b>
  193. <dd>Load services file for server ports.
  194. </dl>
  195. <p>
  196. This option has not been fully documented.
  197. <p><dl compact><dt><b>-N</b>, <b>--nonip</b>
  198. <dd>Send non-IP traffic out server interface.
  199. </dl>
  200. <p>
  201. By default, non-IP traffic which can not be classified as client
  202. or server is classified as "client". Specifiying <b>--nonip</b>
  203. will reclassify non-IP traffic as "server".
  204. <p><dl compact><dt><b>-R</b> <i>string</i>, <b>--ratio</b>=<b><i>string</i></b>
  205. <dd>Ratio of client to server packets.
  206. This option may appear up to 1 times.
  207. This option must appear in combination with the following options:
  208. auto.
  209. </dl>
  210. <p>
  211. Since a given host may have both client and server traffic being sent
  212. to/from it, tcpprep uses a ratio to weigh these packets. If you would
  213. like to override the default of 2:1 server to client packets required for
  214. a host to be classified as a server, specify it as a floating point value.
  215. <p><dl compact><dt><b>-m</b> <i>number</i>, <b>--minmask</b>=<b><i>number</i></b>
  216. <dd>Minimum network mask length in auto mode.
  217. This option may appear up to 1 times.
  218. This option must appear in combination with the following options:
  219. auto.
  220. </dl>
  221. <p>
  222. By default, auto modes use a minimum network mask length of 30 bits
  223. to build networks containing clients and servers. This allows you
  224. to override this value. Larger values will increase performance but
  225. may provide inaccurate results.
  226. <p><dl compact><dt><b>-M</b> <i>number</i>, <b>--maxmask</b>=<b><i>number</i></b>
  227. <dd>Maximum network mask length in auto mode.
  228. This option may appear up to 1 times.
  229. This option must appear in combination with the following options:
  230. auto.
  231. </dl>
  232. <p>
  233. By default, auto modes use a maximum network mask length of 8 bits
  234. to build networks containing clients and servers. This allows you
  235. to override this value. Larger values will decrease performance
  236. and accuracy but will provide greater chance of success.
  237. <p><dl compact><dt><b>-v</b>, <b>--verbose</b>
  238. <dd>Print decoded packets via tcpdump to STDOUT.
  239. This option may appear up to 1 times.
  240. </dl>
  241. <p>
  242. <p><p><dl compact><dt><b>-A</b> <i>string</i>, <b>--decode</b>=<b><i>string</i></b>
  243. <dd>Arguments passed to tcpdump decoder.
  244. This option may appear up to 1 times.
  245. This option must appear in combination with the following options:
  246. verbose.
  247. </dl>
  248. <p>
  249. When enabling verbose mode (<b>-v</b>) you may also specify one or
  250. more additional arguments to pass to <b>tcpdump</b> to modify
  251. the way packets are decoded. By default, -n and -l are used.
  252. Be sure to quote the arguments so that they are not interpreted
  253. by tcprewrite. The following arguments are valid:
  254. [ -aAeNqRStuvxX ]
  255. [ -E spi@ipaddr algo:secret,... ]
  256. [ -s snaplen ]
  257. <p><dl compact><dt><b>-V</b>, <b>--version</b>
  258. <dd>Print version information.
  259. </dl>
  260. <p>
  261. <p><p><dl compact><dt><b>-h</b>, <b>--less-help</b>
  262. <dd>Display less usage information and exit.
  263. </dl>
  264. <p>
  265. This option has not been fully documented.
  266. <p><dl compact><dt><b>-H</b>,<b> --help</b>
  267. <dd>Display usage information and exit.
  268. <dt><b>-!</b>,<b> --more-help</b>
  269. <dd>Extended usage information passed thru pager.
  270. <dt><b>-</b> [<i>rcfile</i>],<b> --save-opts</b>[=<i>rcfile</i>]
  271. <dd>Save the option state to <i>rcfile</i>. The default is the <i>last</i>
  272. configuration file listed in the <b>OPTION PRESETS</b> section, below.
  273. <dt><b>-</b> <i>rcfile</i>,<b> --load-opts</b>=<i>rcfile</i>,<b> --no-load-opts</b>
  274. <dd>Load options from <i>rcfile</i>.
  275. The <i>no-load-opts</i> form will disable the loading
  276. of earlier RC/INI files. <i>--no-load-opts</i> is handled early,
  277. out of order.
  278. </dl>
  279. </ul><H2>OPTION PRESETS </H2><ul>
  280. Any option that is not marked as <i>not presettable</i> may be preset
  281. by loading values from configuration ("RC" or ".INI") file(s).
  282. The <i>homerc</i> file is "<i>$$/</i>", unless that is a directory.
  283. In that case, the file "<i>.tcppreprc</i>"
  284. is searched for within that directory.
  285. </ul><H2>SEE ALSO </H2><ul>
  286. tcpdump(1), tcprewrite(1), tcpreplay(1)
  287. </ul><H2>AUTHOR </H2><ul>
  288. Copyright 2000-2005 Aaron Turner
  289. <p>For support please use the tcpreplay-users@lists.sourceforge.net mailing list.
  290. <p>
  291. Released under the Free BSD License.
  292. <p>
  293. This manual page was <i>AutoGen</i>-erated from the <b>tcpprep</b>
  294. option definitions.
  295. </ul>
  296. <!--#exec cmd="trailer" -->