123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403 |
- .TH TCPPREP 1 2010-04-04 "(tcpprep )" "Programmer's Manual"
- .\" DO NOT EDIT THIS FILE (tcpprep.1)
- .\"
- .\" It has been AutoGen-ed April 4, 2010 at 05:59:19 PM by AutoGen 5.9.9
- .\" From the definitions tcpprep_opts.def
- .\" and the template file agman1.tpl
- .\"
- .SH NAME
- tcpprep \- Create a tcpreplay cache cache file from a pcap file.
- .SH SYNOPSIS
- .B tcpprep
- .\" Mixture of short (flag) options and long options
- .RB [ \-\fIflag\fP " [\fIvalue\fP]]... [" \--\fIopt-name\fP " [[=| ]\fIvalue\fP]]..."
- .PP
- All arguments must be options.
- .PP
- tcpprep is a \fIpcap(3)\fP file pre-processor which creates a cache
- file which provides "rules" for \fItcprewrite(1)\fP and \fItcpreplay(1)\fP
- on how to process and send packets.
- .SH "DESCRIPTION"
- This manual page briefly documents the \fBtcpprep\fP command.
- The basic operation of tcpreplay is to resend all packets from the
- input file(s) out a single file. Tcpprep processes a pcap file and
- applies a set of user-specified rules to create a cache file which
- tells tcpreplay wether or not to send each packet and which interface the
- packet should be sent out of.
- For more details, please see the Tcpreplay Manual at:
- http://tcpreplay.synfin.net/trac/wiki/manual
- .SH OPTIONS
- .TP
- .BR \-d " \fInumber\fP, " \--dbug "=" \fInumber\fP
- Enable debugging output.
- This option may appear up to 1 times.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- in the range 0 through 5
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 0
- .sp
- If configured with \--enable-debug, then you can specify a verbosity
- level for debugging output. Higher numbers increase verbosity.
- .TP
- .BR \-a " \fIstring\fP, " \--auto "=" \fIstring\fP
- Auto-split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- cidr, port, regex, mac.
- .sp
- Tcpprep will try to automatically determine the primary function of hosts
- based on the traffic captured and classify each host as client or server.
- In order to do so, you must provide a hint to tcpprep as to how to search
- for clients and servers. Valid hints are:
- .sp 1
- \fBbridge\fP
- Bridge mode processes each packet to try to determine if the sender is a
- client or server. Once all the packets are processed, the results are weighed
- according to the server/client ratio (\fB--ratio\fP) and systems are assigned an
- interface. If tcpprep is unable to determine what role a system plays, tcpprep
- will abort.
- .sp 1
- \fBrouter\fP
- Router mode works just like bridge mode, except that after weighing is done,
- systems which are undetermined are considered a server if they fall inside a
- network known to contain other servers. Router has a greater chance of
- successfully splitting clients and servers but is not 100% foolproof.
- .sp 1
- \fBclient\fP
- Client mode works just like bridge mode, except that unclassified systems are
- treated as clients. Client mode should always complete successfully.
- .sp 1
- \fBserver\fP
- Server mode works just like bridge mode, except that unclassified systems are
- treated as servers. Server mode should always complete successfully.
- .sp 1
- \fBfirst\fP
- First mode works by looking at the first time each IP is seen in the SRC and DST
- fields in the IP header. If the host is first seen in the SRC field, it is a
- client and if it's first seen in the DST field, it is marked as a server. This
- effectively replicates the processing of the tomahawk test tool. First
- mode should always complete successfully.
- .br
- .TP
- .BR \-c " \fIstring\fP, " \--cidr "=" \fIstring\fP
- CIDR-split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- auto, port, regex, mac.
- .sp
- Specify a comma delimited list of CIDR netblocks to match against
- the source IP of each packet. Packets matching any of the CIDR's
- are classified as servers.
- IPv4 Example:
- .nf
- \--cidr=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
- .fi
- IPv6 Example:
- .nf
- \--cidr=[::ffff:0:0/96],[fe80::/16]
- .fi
- .TP
- .BR \-r " \fIstring\fP, " \--regex "=" \fIstring\fP
- Regex-split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- auto, port, cidr, mac.
- .sp
- Specify a regular expression to match against the source IP of each
- packet. Packets matching the regex are classified as servers.
- .TP
- .BR \-p ", " \--port
- Port-split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- auto, regex, cidr, mac.
- .sp
- Specifies that TCP and UDP traffic over IPv4 and IPv6 should be classified
- as client or server based upon the destination port of the header.
- .TP
- .BR \-e " \fIstring\fP, " \--mac "=" \fIstring\fP
- Source MAC split mode.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- auto, regex, cidr, port.
- .sp
- Specify a list of MAC addresses to match against the source MAC
- of each packet. Packets matching one of the values are classified
- as servers.
- .TP
- .BR \--reverse
- Matches to be client instead of server.
- This option may appear up to 1 times.
- .sp
- Normally the \fB--mac\fP, \fB--regex\fP and \fB--cidr\fP flags specify are used to specify
- the servers and non-IP packets are classified as clients. By using \fB--reverse\fP, these
- features are reversed so that the flags specify clients and non-IP packets are classified as
- servers.
- .TP
- .BR \-C " \fIstring\fP, " \--comment "=" \fIstring\fP
- Embeded cache file comment.
- This option may appear up to 1 times.
- .sp
- Specify a comment to be imbedded within the output cache file and later
- viewed.
- .TP
- .BR \--no-arg-comment
- Do not embed any cache file comment.
- This option may appear up to 1 times.
- .sp
- By default, tcpprep includes the arguments passed on the command line
- in the cache file comment (in addition to any user specified \--comment).
- If for some reason you do not wish to include this, specify this option.
- .TP
- .BR \-x " \fIstring\fP, " \--include "=" \fIstring\fP
- Include only packets matching rule.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- exclude.
- .sp
- Override default of processing all packets stored in the capture file and only
- send/edit packets which match the provided rule. Rules can be one of:
- .sp
- .IR "S:<CIDR1>,..."
- - Source IP must match specified IPv4/v6 CIDR(s)
- .sp
- .IR "D:<CIDR1>,..."
- - Destination IP must match specified IPv4/v6 CIDR(s)
- .sp
- .IR "B:<CIDR1>,..."
- - Both source and destination IP must match specified IPv4/v6 CIDR(s)
- .sp
- .IR "E:<CIDR1>,..."
- - Either IP must match specified IPv4/v6 CIDR(s)
- .sp
- .IR "P:<LIST>"
- - Must be one of the listed packets where the list
- corresponds to the packet number in the capture file.
- .nf
- \-x P:1-5,9,15,72-
- .fi
- would process packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
- end of the file
- .sp
- .IR "F:'<bpf>'"
- - BPF filter. See the \fItcpdump(8)\fP man page for syntax.
- .br
- .TP
- .BR \-X " \fIstring\fP, " \--exclude "=" \fIstring\fP
- Exclude any packet matching this rule.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- include.
- .sp
- Override default of processing all packets stored in the capture file and only
- send/edit packets which do NOT match the provided rule. Rules can be one of:
- .sp
- .IR "S:<CIDR1>,..."
- - Source IP must not match specified IPv4/v6 CIDR(s)
- .sp
- .IR "D:<CIDR1>,..."
- - Destination IP must not match specified IPv4/v6 CIDR(s)
- .sp
- .IR "B:<CIDR1>,..."
- - Both source and destination IP must not match specified IPv4/v6 CIDR(s)
- .sp
- .IR "E:<CIDR1>,..."
- - Either IP must not match specified IPv4/v6 CIDR(s)
- .sp
- .IR "P:<LIST>"
- - Must not be one of the listed packets where the list
- corresponds to the packet number in the capture file.
- .nf
- \-x P:1-5,9,15,72-
- .fi
- would skip packets 1 thru 5, the 9th and 15th packet, and packets 72 until the
- end of the file
- .br
- .TP
- .BR \-o " \fIstring\fP, " \--cachefile "=" \fIstring\fP
- Output cache file.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-i " \fIstring\fP, " \--pcap "=" \fIstring\fP
- Input pcap file to process.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-P " \fIstring\fP, " \--print-comment "=" \fIstring\fP
- Print embedded comment in the specified cache file.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-I " \fIstring\fP, " \--print-info "=" \fIstring\fP
- Print basic info from the specified cache file.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-S " \fIstring\fP, " \--print-stats "=" \fIstring\fP
- Print statistical information about the specified cache file.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-s " \fIstring\fP, " \--services "=" \fIstring\fP
- Load services file for server ports.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- port.
- .sp
- Uses a list of ports used by servers in the same format as of /etc/services:
- <service_name> <port>/<protocol> # comment
- Example:
- http 80/tcp
- .TP
- .BR \-N ", " \--nonip
- Send non-IP traffic out server interface.
- This option may appear up to 1 times.
- .sp
- By default, non-IP traffic which can not be classified as client
- or server is classified as "client". Specifiying \fB--nonip\fP
- will reclassify non-IP traffic as "server". Note that the meaning
- of this flag is reversed if \fB--reverse\fP is used.
- .TP
- .BR \-R " \fIstring\fP, " \--ratio "=" \fIstring\fP
- Ratio of client to server packets.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- auto.
- The default \fIstring\fP for this option is:
- .ti +4
- 2.0
- .sp
- Since a given host may have both client and server traffic being sent
- to/from it, tcpprep uses a ratio to weigh these packets. If you would
- like to override the default of 2:1 server to client packets required for
- a host to be classified as a server, specify it as a floating point value.
- .TP
- .BR \-m " \fInumber\fP, " \--minmask "=" \fInumber\fP
- Minimum network mask length in auto mode.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- auto.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- in the range 0 through 32
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 30
- .sp
- By default, auto modes use a minimum network mask length of 30 bits
- to build networks containing clients and servers. This allows you
- to override this value. Larger values will increase performance but
- may provide inaccurate results.
- .TP
- .BR \-M " \fInumber\fP, " \--maxmask "=" \fInumber\fP
- Maximum network mask length in auto mode.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- auto.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- in the range 0 through 32
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 8
- .sp
- By default, auto modes use a maximum network mask length of 8 bits
- to build networks containing clients and servers. This allows you
- to override this value. Larger values will decrease performance
- and accuracy but will provide greater chance of success.
- .TP
- .BR \-v ", " \--verbose
- Print decoded packets via tcpdump to STDOUT.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-A " \fIstring\fP, " \--decode "=" \fIstring\fP
- Arguments passed to tcpdump decoder.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- verbose.
- .sp
- When enabling verbose mode (\fB-v\fP) you may also specify one or
- more additional arguments to pass to \fBtcpdump\fP to modify
- the way packets are decoded. By default, \-n and \-l are used.
- Be sure to quote the arguments so that they are not interpreted
- by tcprewrite. The following arguments are valid:
- [ \-aAeNqRStuvxX ]
- [ \-E spi@ipaddr algo:secret,... ]
- [ \-s snaplen ]
- .TP
- .BR \-V ", " \--version
- Print version information.
- .sp
- .TP
- .BR \-h ", " \--less-help
- Display less usage information and exit.
- .sp
- This option has not been fully documented.
- .TP
- .BR \-H , " \--help"
- Display usage information and exit.
- .TP
- .BR \-! , " \--more-help"
- Extended usage information passed thru pager.
- .TP
- .BR \- " [\fIrcfile\fP]," " \--save-opts" "[=\fIrcfile\fP]"
- Save the option state to \fIrcfile\fP. The default is the \fIlast\fP
- configuration file listed in the \fBOPTION PRESETS\fP section, below.
- .TP
- .BR \- " \fIrcfile\fP," " \--load-opts" "=\fIrcfile\fP," " \--no-load-opts"
- Load options from \fIrcfile\fP.
- The \fIno-load-opts\fP form will disable the loading
- of earlier RC/INI files. \fI--no-load-opts\fP is handled early,
- out of order.
- .SH OPTION PRESETS
- Any option that is not marked as \fInot presettable\fP may be preset
- by loading values from configuration ("RC" or ".INI") file(s).
- The \fIhomerc\fP file is "\fI$$/\fP", unless that is a directory.
- In that case, the file "\fI.tcppreprc\fP"
- is searched for within that directory.
- .SH "SEE ALSO"
- tcpdump(1), tcprewrite(1), tcpreplay(1)
- .SH AUTHOR
- Copyright 2000-2010 Aaron Turner
- For support please use the tcpreplay-users@lists.sourceforge.net mailing list.
- The latest version of this software is always available from:
- http://tcpreplay.synfin.net/
- .PP
- Released under the Free BSD License.
- .PP
- This manual page was \fIAutoGen\fP-erated from the \fBtcpprep\fP
- option definitions.
|