tcpprep_opts.def 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562
  1. autogen definitions options;
  2. copyright = {
  3. date = "2000 - 2004";
  4. owner = "Aaron Turner";
  5. type = "bsd";
  6. author = <<- EOText
  7. Copyright 2000-2005 Aaron Turner
  8. For support please use the tcpreplay-users@lists.sourceforge.net mailing list.
  9. EOText;
  10. };
  11. package = "tcpprep";
  12. prog-name = "tcpprep";
  13. prog-title = "Create a tcpreplay cache cache file from a pcap file.";
  14. long-opts;
  15. gnu-usage;
  16. help-value = "H";
  17. save-opts-value = "";
  18. load-opts-value = "";
  19. config-header = "config.h";
  20. include = "#include \"defines.h\"\n"
  21. "#include \"common.h\"\n"
  22. "#include \"tcpprep.h\"\n"
  23. "extern char pcap_version[];\n"
  24. "extern tcpprep_opt_t options;\n";
  25. homerc = "$$/";
  26. explain = <<- EOExplain
  27. tcpprep is a @file{pcap(3)} file pre-processor which creates a cache
  28. file which provides "rules" for @file{tcprewrite(1)} and @file{tcpreplay(1)}
  29. on how to process and send packets.
  30. EOExplain;
  31. detail = <<- EODetail
  32. The basic operation of tcpreplay is to resend all packets from the
  33. input file(s) out a single file. Tcpprep processes a pcap file and
  34. applies a set of user-specified rules to create a cache file which
  35. tells tcpreplay wether or not to send each packet and which interface the
  36. packet should be sent out of.
  37. EODetail;
  38. man-doc = <<- EOMan
  39. .SH "SEE ALSO"
  40. tcpdump(1), tcprewrite(1), tcpreplay(1)
  41. EOMan;
  42. flag = {
  43. name = dbug;
  44. value = d;
  45. arg-type = number;
  46. max = 1;
  47. immediate;
  48. arg-range = "0->5";
  49. arg-default = 0;
  50. descrip = "Enable debugging output";
  51. doc = <<- EOText
  52. If configured with --enable-debug, then you can specify a verbosity
  53. level for debugging output. Higher numbers increase verbosity.
  54. EOText;
  55. };
  56. /* Modes: -a bridge/router/client/server, -c (cidr) */
  57. flag = {
  58. name = auto;
  59. value = a;
  60. descrip = "Auto-split mode";
  61. arg-type = string;
  62. max = 1;
  63. flags-cant = cidr;
  64. flags-cant = port;
  65. flags-cant = regex;
  66. flags-cant = mac;
  67. flag-code = <<- EOAuto
  68. options.mode = AUTO_MODE;
  69. if (strcmp(OPT_ARG(AUTO), "bridge") == 0) {
  70. options.automode = BRIDGE_MODE;
  71. }
  72. else if (strcmp(OPT_ARG(AUTO), "router") == 0) {
  73. options.automode = ROUTER_MODE;
  74. }
  75. else if (strcmp(OPT_ARG(AUTO), "client") == 0) {
  76. options.automode = CLIENT_MODE;
  77. }
  78. else if (strcmp(OPT_ARG(AUTO), "server") == 0) {
  79. options.automode = SERVER_MODE;
  80. }
  81. else {
  82. errx(1, "Invalid auto mode type: %s", OPT_ARG(AUTO));
  83. }
  84. EOAuto;
  85. doc = <<- EOText
  86. Tcpprep will try to automatically determine the primary function of hosts
  87. based on the traffic captured and classify each host as client or server.
  88. In order to do so, you must provide a hint to tcpprep as to how to search
  89. for clients and servers. Valid hints are:
  90. @table @bullet
  91. @item
  92. @var{bridge}
  93. Bridge mode processes each packet to try to determine if the sender is a
  94. client or server. Once all the packets are processed, the results are weighed
  95. according to the server/client ratio (@samp{--ratio}) and systems are assigned an
  96. interface. If tcpprep is unable to determine what role a system plays, tcpprep
  97. will abort.
  98. @item
  99. @var{router}
  100. Router mode works just like bridge mode, except that after weighing is done,
  101. systems which are undetermined are considered a server if they fall inside a
  102. network known to contain other servers. Router has a greater chance of
  103. successfully splitting clients and servers but is not 100% foolproof.
  104. @item
  105. @var{client}
  106. Client mode works just like bridge mode, except that unclassified systems are
  107. treated as clients. Client mode should always complete successfully.
  108. @item
  109. @var{server}
  110. Server mode works just like bridge mode, except that unclassified systems are
  111. treated as servers. Server mode should always complete successfully.
  112. @end table
  113. EOText;
  114. };
  115. flag = {
  116. name = cidr;
  117. value = c;
  118. descrip = "CIDR-split mode";
  119. arg-type = string;
  120. max = 1;
  121. flags-cant = auto;
  122. flags-cant = port;
  123. flags-cant = regex;
  124. flags-cant = mac;
  125. flag-code = <<- EOCidr
  126. char *cidr = safe_strdup(OPT_ARG(CIDR));
  127. options.mode = CIDR_MODE;
  128. if (!parse_cidr(&options.cidrdata, cidr, ","))
  129. errx(1, "Unable to parse CIDR map: %s", OPT_ARG(CIDR));
  130. free(cidr);
  131. EOCidr;
  132. doc = <<- EOText
  133. Specify a comma delimited list of CIDR netblocks to match against
  134. the source IP of each packet. Packets matching any of the CIDR's
  135. are classified as servers.
  136. EOText;
  137. };
  138. flag = {
  139. name = regex;
  140. value = r;
  141. descrip = "Regex-split mode";
  142. arg-type = string;
  143. max = 1;
  144. flags-cant = auto;
  145. flags-cant = port;
  146. flags-cant = cidr;
  147. flags-cant = mac;
  148. flag-code = <<- EORegex
  149. int regex_error;
  150. char ebuf[EBUF_SIZE];
  151. options.mode = REGEX_MODE;
  152. if ((regex_error = regcomp(&options.preg, OPT_ARG(REGEX),
  153. REG_EXTENDED|REG_NOSUB))) {
  154. regerror(regex_error, &options.preg, ebuf, EBUF_SIZE);
  155. errx(1, "Unable to compile regex: %s", ebuf);
  156. }
  157. EORegex;
  158. doc = <<- EOText
  159. Specify a regular expression to match against the source IP of each
  160. packet. Packets matching the regex are classified as servers.
  161. EOText;
  162. };
  163. flag = {
  164. name = port;
  165. value = p;
  166. descrip = "Port-split mode";
  167. max = 1;
  168. flags-cant = auto;
  169. flags-cant = regex;
  170. flags-cant = cidr;
  171. flags-cant = mac;
  172. flag-code = <<- EOPort
  173. options.mode = PORT_MODE;
  174. EOPort;
  175. doc = <<- EOText
  176. Specifies that TCP and UDP traffic should be classified as client
  177. or server based upon the destination port of the header.
  178. EOText;
  179. };
  180. flag = {
  181. name = mac;
  182. value = e;
  183. arg-type = string;
  184. max = 1;
  185. descrip = "Source MAC split mode";
  186. flags-cant = auto;
  187. flags-cant = regex;
  188. flags-cant = cidr;
  189. flags-cant = port;
  190. flag-code = <<- EOMac
  191. options.mode = MAC_MODE;
  192. options.maclist = safe_strdup(OPT_ARG(MAC));
  193. EOMac;
  194. doc = <<- EOText
  195. Specify a list of MAC addresses to match against the source MAC
  196. of each packet. Packets matching one of the values are classified
  197. as servers.
  198. EOText;
  199. };
  200. flag = {
  201. name = comment;
  202. value = C;
  203. arg-type = string;
  204. max = 1;
  205. descrip = "Embeded cache file comment";
  206. flag-code = <<- EOComment
  207. /* our comment_len is only 16bit - myargs[] */
  208. if (strlen(OPT_ARG(COMMENT)) > ((1 << 16) - 1 - MYARGS_LEN))
  209. errx(1, "Comment length %d is longer then max allowed (%d)",
  210. strlen(OPT_ARG(COMMENT)), (1 << 16) - 1 - MYARGS_LEN);
  211. /* save the comment */
  212. options.comment = (char *)safe_malloc(strlen(OPT_ARG(COMMENT)) + 1);
  213. strcpy(options.comment, OPT_ARG(COMMENT));
  214. EOComment;
  215. doc = <<- EOText
  216. Specify a comment to be imbedded within the output cache file and later
  217. viewed.
  218. EOText;
  219. };
  220. flag = {
  221. name = no-arg-comment;
  222. max = 1;
  223. descrip = "Do not embed any cache file comment";
  224. flag-code = <<- EOCode
  225. options.nocomment = 1;
  226. EOCode;
  227. doc = <<- EOText
  228. By default, tcpprep includes the arguments passed on the command line
  229. in the cache file comment (in addition to any user specified --comment).
  230. If for some reason you do not wish to include this, specify this option.
  231. EOText;
  232. };
  233. /* Include/Exclude */
  234. flag = {
  235. name = include;
  236. value = x;
  237. arg-type = string;
  238. max = 1;
  239. descrip = "Include only packets matching rule";
  240. flags-cant = exclude;
  241. flag-code = <<- EOInclude
  242. char *include;
  243. include = safe_strdup(OPT_ARG(INCLUDE));
  244. options.xX.mode = xX_MODE_INCLUDE;
  245. if ((options.xX.mode = parse_xX_str(&options.xX, include, &options.bpf)) == xXError)
  246. errx(1, "Unable to parse include/exclude rule: %s", OPT_ARG(INCLUDE));
  247. free(include);
  248. EOInclude;
  249. doc = <<- EOText
  250. Override default of sending all packets stored in the capture file and only
  251. send packets which match the provided rule. Rules can be one of:
  252. @table @bullet
  253. @item S:<CIDR1>,...
  254. - Source IP must match specified CIDR(s)
  255. @item D:<CIDR1>,...
  256. - Destination IP must match specified CIDR(s)
  257. @item B:<CIDR1>,...
  258. - Both source and destination IP must match specified CIDR(s)
  259. @item E:<CIDR1>,...
  260. - Either IP must match specified CIDR(s)
  261. @item P:<LIST>
  262. - Must be one of the listed packets where the list
  263. corresponds to the packet number in the capture file.
  264. @example
  265. -x P:1-5,9,15,72-
  266. @end example
  267. would send packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
  268. end of the file
  269. @item F:'<bpf>'
  270. - BPF filter. See the @file{tcpdump(8)} man page for syntax.
  271. @end table
  272. EOText;
  273. };
  274. flag = {
  275. name = exclude;
  276. value = X;
  277. arg-type = string;
  278. max = 1;
  279. descrip = "Exclude any packet matching this rule";
  280. flags-cant = include;
  281. flag-code = <<- EOExclude
  282. char *exclude;
  283. exclude = safe_strdup(OPT_ARG(EXCLUDE));
  284. options.xX.mode = xX_MODE_EXCLUDE;
  285. if ((options.xX.mode = parse_xX_str(&options.xX, exclude, &options.bpf)) == xXError)
  286. errx(1, "Unable to parse include/exclude rule: %s", OPT_ARG(EXCLUDE));
  287. free(exclude);
  288. EOExclude;
  289. doc = <<- EOText
  290. Override default of sending all packets stored in the capture file and only
  291. send packets which do not match the provided rule. Rules can be one of:
  292. @table @bullet
  293. @item S:<CIDR1>,...
  294. - Source IP must not match specified CIDR(s)
  295. @item D:<CIDR1>,...
  296. - Destination IP must not match specified CIDR(s)
  297. @item B:<CIDR1>,...
  298. - Both source and destination IP must not match specified CIDR(s)
  299. @item E:<CIDR1>,...
  300. - Either IP must not match specified CIDR(s)
  301. @item P:<LIST>
  302. - Must not be one of the listed packets where the list
  303. corresponds to the packet number in the capture file.
  304. @example
  305. -x P:1-5,9,15,72-
  306. @end example
  307. would drop packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
  308. end of the file
  309. @end table
  310. EOText;
  311. };
  312. flag = {
  313. name = cachefile;
  314. value = o;
  315. arg-type = string;
  316. max = 1;
  317. descrip = "Output cache file";
  318. doc = "";
  319. };
  320. flag = {
  321. name = pcap;
  322. value = i;
  323. descrip = "Input pcap file to process";
  324. arg-type = string;
  325. max = 1;
  326. doc = "";
  327. };
  328. flag = {
  329. name = print-comment;
  330. value = P;
  331. arg-type = string;
  332. descrip = "Print embedded comment in the specified cache file";
  333. doc = "";
  334. };
  335. flag = {
  336. name = print-info;
  337. value = I;
  338. arg-type = string;
  339. descrip = "Print basic info from the specified cache file";
  340. doc = "";
  341. };
  342. flag = {
  343. name = print-stats;
  344. value = S;
  345. arg-type = string;
  346. descrip = "Print statistical information about the specified cache file";
  347. doc = "";
  348. };
  349. flag = {
  350. name = services;
  351. value = s;
  352. descrip = "Load services file for server ports";
  353. flag-must = port;
  354. arg-type = string;
  355. flag-code = <<- EOServices
  356. parse_services(OPT_ARG(SERVICES), &options.services);
  357. EOServices;
  358. };
  359. flag = {
  360. name = nonip;
  361. value = N;
  362. descrip = "Send non-IP traffic out server interface";
  363. flag-code = <<- EONonip
  364. options.nonip = SERVER;
  365. EONonip;
  366. doc = <<- EOText
  367. By default, non-IP traffic which can not be classified as client
  368. or server is classified as "client". Specifiying @samp{--nonip}
  369. will reclassify non-IP traffic as "server".
  370. EOText;
  371. };
  372. flag = {
  373. name = ratio;
  374. value = R;
  375. arg-type = string;
  376. max = 1;
  377. flags-must = auto;
  378. descrip = "Ratio of client to server packets";
  379. flag-code = <<- EORatio
  380. options.ratio = atof(OPT_ARG(RATIO));
  381. EORatio;
  382. doc = <<- EOText
  383. Since a given host may have both client and server traffic being sent
  384. to/from it, tcpprep uses a ratio to weigh these packets. If you would
  385. like to override the default of 2:1 server to client packets required for
  386. a host to be classified as a server, specify it as a floating point value.
  387. EOText;
  388. };
  389. flag = {
  390. name = minmask;
  391. value = m;
  392. descrip = "Minimum network mask length in auto mode";
  393. flags-must = auto;
  394. max = 1;
  395. arg-type = number;
  396. arg-range = "0->32";
  397. doc = <<- EOText
  398. By default, auto modes use a minimum network mask length of 30 bits
  399. to build networks containing clients and servers. This allows you
  400. to override this value. Larger values will increase performance but
  401. may provide inaccurate results.
  402. EOText;
  403. };
  404. flag = {
  405. name = maxmask;
  406. value = M;
  407. descrip = "Maximum network mask length in auto mode";
  408. flags-must = auto;
  409. max = 1;
  410. arg-type = number;
  411. arg-range = "0->32";
  412. doc = <<- EOText
  413. By default, auto modes use a maximum network mask length of 8 bits
  414. to build networks containing clients and servers. This allows you
  415. to override this value. Larger values will decrease performance
  416. and accuracy but will provide greater chance of success.
  417. EOText;
  418. };
  419. flag = {
  420. ifdef = HAVE_TCPDUMP;
  421. name = verbose;
  422. value = v;
  423. max = 1;
  424. immediate;
  425. descrip = "Print decoded packets via tcpdump to STDOUT";
  426. settable;
  427. doc = "";
  428. };
  429. flag = {
  430. ifdef = HAVE_TCPDUMP;
  431. name = decode;
  432. flags-must = verbose;
  433. value = A;
  434. arg-type = string;
  435. max = 1;
  436. descrip = "Arguments passed to tcpdump decoder";
  437. doc = <<- EOText
  438. When enabling verbose mode (@samp{-v}) you may also specify one or
  439. more additional arguments to pass to @code{tcpdump} to modify
  440. the way packets are decoded. By default, -n and -l are used.
  441. Be sure to quote the arguments so that they are not interpreted
  442. by tcprewrite. The following arguments are valid:
  443. [ -aAeNqRStuvxX ]
  444. [ -E spi@ipaddr algo:secret,... ]
  445. [ -s snaplen ]
  446. EOText;
  447. };
  448. flag = {
  449. name = version;
  450. value = V;
  451. descrip = "Print version information";
  452. flag-code = <<- EOVersion
  453. fprintf(stderr, "tcpprep version: %s (build %s)", VERSION, svn_version());
  454. #ifdef DEBUG
  455. fprintf(stderr, " (debug)");
  456. #endif
  457. fprintf(stderr, "\n");
  458. fprintf(stderr, "Copyright 2001-2006 by Aaron Turner <aturner@synfin.net>\n");
  459. fprintf(stderr, "Cache file supported: %s\n", CACHEVERSION);
  460. fprintf(stderr, "Compiled against libnet: %s\n", LIBNET_VERSION);
  461. fprintf(stderr, "Compiled against libpcap: %s\n", pcap_version);
  462. #ifdef ENABLE_64BITS
  463. fprintf(stderr, "64 bit packet counters: enabled\n");
  464. #else
  465. fprintf(stderr, "64 bit packet counters: disabled\n");
  466. #endif
  467. #ifdef HAVE_TCPDUMP
  468. fprintf(stderr, "Verbose printing via tcpdump: enabled\n");
  469. #else
  470. fprintf(stderr, "Verbose printing via tcpdump: disabled\n");
  471. #endif
  472. exit(0);
  473. EOVersion;
  474. doc = "";
  475. };
  476. flag = {
  477. name = less-help;
  478. value = "h";
  479. immediate;
  480. descrip = "Display less usage information and exit";
  481. flag-code = <<- EOHelp
  482. USAGE(EXIT_FAILURE);
  483. EOHelp;
  484. };