tcpprep(1)
NAME
tcpprep - Create a tcpreplay cache cache file from a pcap file.
SYNOPSIS
tcpprep [-flag [value]]... [--opt-name [[=| ]value]]... All arguments must be options. tcpprep is a pcap(3) file pre-processor which creates a cache file which provides "rules" for tcprewrite(1) and tcpreplay(1) on how to process and send packets.
DESCRIPTION
This manual page briefly documents the tcpprep command. The basic operation of tcpreplay is to resend all packets from the input file(s) out a single file. Tcpprep processes a pcap file and applies a set of user-specified rules to create a cache file which tells tcpreplay wether or not to send each packet and which interface the packet should be sent out of. For more details, please see the Tcpreplay Manual at: http://tcpreplay.synfin.net/trac/wiki/manual
OPTIONS
-d number, --dbug=number
Enable debugging output. This option may appear up to 1 times.
This option takes an integer number as its argument. The value
of number is constrained to being:
in the range 0 through 5
The default number for this option is:
0
If configured with --enable-debug, then you can specify a
verbosity level for debugging output. Higher numbers increase
verbosity.
-a string, --auto=string
Auto-split mode. This option may appear up to 1 times. This
option must not appear in combination with any of the following
options: cidr, port, regex, mac.
Tcpprep will try to automatically determine the primary function
of hosts based on the traffic captured and classify each host as
client or server. In order to do so, you must provide a hint to
tcpprep as to how to search for clients and servers. Valid
hints are:
bridge Bridge mode processes each packet to try to determine if
the sender is a client or server. Once all the packets are
processed, the results are weighed according to the
server/client ratio (--ratio) and systems are assigned an
interface. If tcpprep is unable to determine what role a system
plays, tcpprep will abort.
router Router mode works just like bridge mode, except that
after weighing is done, systems which are undetermined are
considered a server if they fall inside a network known to
contain other servers. Router has a greater chance of
successfully splitting clients and servers but is not 100%
foolproof.
client Client mode works just like bridge mode, except that
unclassified systems are treated as clients. Client mode should
always complete successfully.
server Server mode works just like bridge mode, except that
unclassified systems are treated as servers. Server mode should
always complete successfully.
first First mode works by looking at the first time each IP is
seen in the SRC and DST fields in the IP header. If the host is
first seen in the SRC field, it is a client and if it's first
seen in the DST field, it is marked as a server. This
effectively replicates the processing of the tomahawk test tool.
First mode should always complete successfully.
-c string, --cidr=string
CIDR-split mode. This option may appear up to 1 times. This
option must not appear in combination with any of the following
options: auto, port, regex, mac.
Specify a comma delimited list of CIDR netblocks to match
against the source IP of each packet. Packets matching any of
the CIDR's are classified as servers.
IPv4 Example:
--cidr=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
IPv6 Example:
--cidr=[::ffff:0:0/96],[fe80::/16]
-r string, --regex=string
Regex-split mode. This option may appear up to 1 times. This
option must not appear in combination with any of the following
options: auto, port, cidr, mac.
Specify a regular expression to match against the source IP of
each packet. Packets matching the regex are classified as
servers.
-p, --port
Port-split mode. This option may appear up to 1 times. This
option must not appear in combination with any of the following
options: auto, regex, cidr, mac.
Specifies that TCP and UDP traffic over IPv4 and IPv6 should be
classified as client or server based upon the destination port
of the header.
-e string, --mac=string
Source MAC split mode. This option may appear up to 1 times.
This option must not appear in combination with any of the
following options: auto, regex, cidr, port.
Specify a list of MAC addresses to match against the source MAC
of each packet. Packets matching one of the values are
classified as servers.
--reverse
Matches to be client instead of server. This option may appear
up to 1 times.
Normally the --mac, --regex and --cidr flags specify are used to
specify the servers and non-IP packets are classified as
clients. By using --reverse, these features are reversed so
that the flags specify clients and non-IP packets are classified
as servers.
-C string, --comment=string
Embeded cache file comment. This option may appear up to 1
times.
Specify a comment to be imbedded within the output cache file
and later viewed.
--no-arg-comment
Do not embed any cache file comment. This option may appear up
to 1 times.
By default, tcpprep includes the arguments passed on the command
line in the cache file comment (in addition to any user
specified --comment). If for some reason you do not wish to
include this, specify this option.
-x string, --include=string
Include only packets matching rule. This option may appear up
to 1 times. This option must not appear in combination with any
of the following options: exclude.
Override default of processing all packets stored in the capture
file and only send/edit packets which match the provided rule.
Rules can be one of:
S:<CIDR1>,... - Source IP must match specified IPv4/v6 CIDR(s)
D:<CIDR1>,... - Destination IP must match specified IPv4/v6
CIDR(s)
B:<CIDR1>,... - Both source and destination IP must match
specified IPv4/v6 CIDR(s)
E:<CIDR1>,... - Either IP must match specified IPv4/v6 CIDR(s)
P:<LIST> - Must be one of the listed packets where the list
corresponds to the packet number in the capture file.
-x P:1-5,9,15,72-
would process packets 1 thru 5, the 9th and 15th packet, and
packets 72 until the end of the file
F:'<bpf>' - BPF filter. See the tcpdump(8) man page for syntax.
-X string, --exclude=string
Exclude any packet matching this rule. This option may appear
up to 1 times. This option must not appear in combination with
any of the following options: include.
Override default of processing all packets stored in the capture
file and only send/edit packets which do NOT match the provided
rule. Rules can be one of:
S:<CIDR1>,... - Source IP must not match specified IPv4/v6
CIDR(s)
D:<CIDR1>,... - Destination IP must not match specified IPv4/v6
CIDR(s)
B:<CIDR1>,... - Both source and destination IP must not match
specified IPv4/v6 CIDR(s)
E:<CIDR1>,... - Either IP must not match specified IPv4/v6
CIDR(s)
P:<LIST> - Must not be one of the listed packets where the list
corresponds to the packet number in the capture file.
-x P:1-5,9,15,72-
would skip packets 1 thru 5, the 9th and 15th packet, and
packets 72 until the end of the file
-o string, --cachefile=string
Output cache file. This option may appear up to 1 times.
-i string, --pcap=string
Input pcap file to process. This option may appear up to 1
times.
-P string, --print-comment=string
Print embedded comment in the specified cache file. This option
may appear up to 1 times.
-I string, --print-info=string
Print basic info from the specified cache file. This option may
appear up to 1 times.
-S string, --print-stats=string
Print statistical information about the specified cache file.
This option may appear up to 1 times.
-s string, --services=string
Load services file for server ports. This option may appear up
to 1 times. This option must appear in combination with the
following options: port.
Uses a list of ports used by servers in the same format as of
/etc/services: <service_name> <port>/<protocol> # comment
Example: http 80/tcp
-N, --nonip
Send non-IP traffic out server interface. This option may
appear up to 1 times.
By default, non-IP traffic which can not be classified as client
or server is classified as "client". Specifiying --nonip will
reclassify non-IP traffic as "server". Note that the meaning of
this flag is reversed if --reverse is used.
-R string, --ratio=string
Ratio of client to server packets. This option may appear up to
1 times. This option must appear in combination with the
following options: auto. The default string for this option is:
2.0
Since a given host may have both client and server traffic being
sent to/from it, tcpprep uses a ratio to weigh these packets.
If you would like to override the default of 2:1 server to
client packets required for a host to be classified as a server,
specify it as a floating point value.
-m number, --minmask=number
Minimum network mask length in auto mode. This option may
appear up to 1 times. This option must appear in combination
with the following options: auto. This option takes an integer
number as its argument. The value of number is constrained to
being:
in the range 0 through 32
The default number for this option is:
30
By default, auto modes use a minimum network mask length of 30
bits to build networks containing clients and servers. This
allows you to override this value. Larger values will increase
performance but may provide inaccurate results.
-M number, --maxmask=number
Maximum network mask length in auto mode. This option may
appear up to 1 times. This option must appear in combination
with the following options: auto. This option takes an integer
number as its argument. The value of number is constrained to
being:
in the range 0 through 32
The default number for this option is:
8
By default, auto modes use a maximum network mask length of 8
bits to build networks containing clients and servers. This
allows you to override this value. Larger values will decrease
performance and accuracy but will provide greater chance of
success.
-v, --verbose
Print decoded packets via tcpdump to STDOUT. This option may
appear up to 1 times.
-A string, --decode=string
Arguments passed to tcpdump decoder. This option may appear up
to 1 times. This option must appear in combination with the
following options: verbose.
When enabling verbose mode (-v) you may also specify one or more
additional arguments to pass to tcpdump to modify the way
packets are decoded. By default, -n and -l are used. Be sure
to quote the arguments so that they are not interpreted by
tcprewrite. The following arguments are valid:
[ -aAeNqRStuvxX ]
[ -E spi@ipaddr algo:secret,... ]
[ -s snaplen ]
-V, --version
Print version information.
-h, --less-help
Display less usage information and exit.
This option has not been fully documented.
-H, --help
Display usage information and exit.
-!, --more-help
Extended usage information passed thru pager.
- [rcfile], --save-opts[=rcfile]
Save the option state to rcfile. The default is the last
configuration file listed in the OPTION PRESETS section, below.
- rcfile, --load-opts=rcfile, --no-load-opts
Load options from rcfile. The no-load-opts form will disable
the loading of earlier RC/INI files. --no-load-opts is handled
early, out of order.
OPTION PRESETS
Any option that is not marked as not presettable may be preset by
loading values from configuration ("RC" or ".INI") file(s). The homerc
file is "$$/", unless that is a directory. In that case, the file
".tcppreprc" is searched for within that directory.
SEE ALSO
tcpdump(1), tcprewrite(1), tcpreplay(1)
AUTHOR
Copyright 2000-2010 Aaron Turner For support please use the [email protected] mailing list. The latest version of this software is always available from: http://tcpreplay.synfin.net/ Released under the Free BSD License. This manual page was AutoGen-erated from the tcpprep option definitions. (tcpprep ) 2010-04-04 TCPPREP(1)
Opportunity
Personal Opportunity - Free software gives you access to billions of dollars of software at no cost. Use this software for your business, personal use or to develop a profitable skill. Access to source code provides access to a level of capabilities/information that companies protect though copyrights. Open source is a core component of the Internet and it is available to you. Leverage the billions of dollars in resources and capabilities to build a career, establish a business or change the world. The potential is endless for those who understand the opportunity.
Business Opportunity - Goldman Sachs, IBM and countless large corporations are leveraging open source to reduce costs, develop products and increase their bottom lines. Learn what these companies know about open source and how open source can give you the advantage.
Free Software
Free Software provides computer programs and capabilities at no cost but more importantly, it provides the freedom to run, edit, contribute to, and share the software. The importance of free software is a matter of access, not price. Software at no cost is a benefit but ownership rights to the software and source code is far more significant.
Free Office Software - The Libre Office suite provides top desktop productivity tools for free. This includes, a word processor, spreadsheet, presentation engine, drawing and flowcharting, database and math applications. Libre Office is available for Linux or Windows.
Free Books
The Free Books Library is a collection of thousands of the most popular public domain books in an online readable format. The collection includes great classical literature and more recent works where the U.S. copyright has expired. These books are yours to read and use without restrictions.
Source Code - Want to change a program or know how it works? Open Source provides the source code for its programs so that anyone can use, modify or learn how to write those programs themselves. Visit the GNU source code repositories to download the source.
Education
Study at Harvard, Stanford or MIT - Open edX provides free online courses from Harvard, MIT, Columbia, UC Berkeley and other top Universities. Hundreds of courses for almost all major subjects and course levels. Open edx also offers some paid courses and selected certifications.
Linux Manual Pages - A man or manual page is a form of software documentation found on Linux/Unix operating systems. Topics covered include computer programs (including library and system calls), formal standards and conventions, and even abstract concepts.
