1tcpprep(1) User Commands tcpprep(1)
2
6 tcpprep - Create a tcpreplay cache cache file from a pcap file.
7
9 tcpprep [-flags] [-flag [value]] [--option-name[[=| ]value]]
10 All arguments must be options.
12 tcpprep is a pcap(3) file pre-processor which creates a cache file
14 which provides "rules" for tcprewrite(1) and tcpreplay(1) on how to
15 process and send packets.
16
18 The basic operation of tcpreplay is to resend all packets from the
19 input file(s) out a single file. Tcpprep processes a pcap file and
20 applies a set of user-specified rules to create a cache file which
21 tells tcpreplay whether or not to send each packet and which interface
22 the packet should be sent out of.
23 For more details, please see the Tcpreplay Manual at: http://tcpre‐
25 play.appneta.com
26
28 -d number, --dbug=number
29 Enable debugging output. This option may appear up to 1 times.
30 This option takes an integer number as its argument. The value
31 of number is constrained to being:
32 in the range 0 through 5
33 The default number for this option is:
34 0
35 If configured with --enable-debug, then you can specify a ver‐
37 bosity level for debugging output. Higher numbers increase ver‐
38 bosity.
39 -a string, --auto=string
41 Auto-split mode. This option may appear up to 1 times. This
42 option must not appear in combination with any of the following
43 options: cidr, port, regex, mac.
44 Tcpprep will try to automatically determine the primary function
46 of hosts based on the traffic captured and classify each host as
47 client or server. In order to do so, you must provide a hint to
48 tcpprep as to how to search for clients and servers. Valid
49 hints are:
50 bridge Bridge mode processes each packet to try to determine if
53 the sender is a client or server. Once all the packets are pro‐
54 cessed, the results are weighed according to the server/client
55 ratio (--ratio) and systems are assigned an interface. If tcp‐
56 prep is unable to determine what role a system plays, tcpprep
57 will abort.
58 router Router mode works just like bridge mode, except that
60 after weighing is done, systems which are undetermined are con‐
61 sidered a server if they fall inside a network known to contain
62 other servers. Router has a greater chance of successfully
63 splitting clients and servers but is not 100% foolproof.
64 client Client mode works just like bridge mode, except that
66 unclassified systems are treated as clients. Client mode should
67 always complete successfully.
68 server Server mode works just like bridge mode, except that
70 unclassified systems are treated as servers. Server mode should
71 always complete successfully.
72 first First mode works by looking at the first time each IP is
74 seen in the SRC and DST fields in the IP header. If the host is
75 first seen in the SRC field, it is a client and if it's first
76 seen in the DST field, it is marked as a server. This effec‐
77 tively replicates the processing of the tomahawk test tool.
78 First mode should always complete successfully.
79 -c string, --cidr=string
81 CIDR-split mode. This option may appear up to 1 times. This
82 option must not appear in combination with any of the following
83 options: auto, port, regex, mac.
84 Specify a comma delimited list of CIDR netblocks to match
86 against the source IP of each packet. Packets matching any of
87 the CIDR's are classified as servers.
88 IPv4 Example:
90 --cidr=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
91 IPv6 Example:
92 --cidr=[::ffff:0:0/96],[fe80::/16]
93 -r string, --regex=string
95 Regex-split mode. This option may appear up to 1 times. This
96 option must not appear in combination with any of the following
97 options: auto, port, cidr, mac.
98 Specify a regular expression to match against the source IP of
100 each packet. Packets matching the regex are classified as
101 servers.
102 -p, --port
104 Port-split mode. This option may appear up to 1 times. This
105 option must not appear in combination with any of the following
106 options: auto, regex, cidr, mac.
107 Specifies that TCP and UDP traffic over IPv4 and IPv6 should be
109 classified as client or server based upon the destination port
110 of the header.
111 -e string, --mac=string
113 Source MAC split mode. This option may appear up to 1 times.
114 This option must not appear in combination with any of the fol‐
115 lowing options: auto, regex, cidr, port.
116 Specify a list of MAC addresses to match against the source MAC
118 of each packet. Packets matching one of the values are classi‐
119 fied as servers.
120 --reverse
122 Matches to be client instead of server. This option may appear
123 up to 1 times.
124 Normally the --mac, --regex and --cidr flags specify are used to
126 specify the servers and non-IP packets are classified as
127 clients. By using --reverse, these features are reversed so
128 that the flags specify clients and non-IP packets are classified
129 as servers.
130 -C string, --comment=string
132 Embedded cache file comment. This option may appear up to 1
133 times.
134 Specify a comment to be imbedded within the output cache file
136 and later viewed.
137 --no-arg-comment
139 Do not embed any cache file comment. This option may appear up
140 to 1 times.
141 By default, tcpprep includes the arguments passed on the command
143 line in the cache file comment (in addition to any user speci‐
144 fied --comment). If for some reason you do not wish to include
145 this, specify this option.
146 -x string, --include=string
148 Include only packets matching rule. This option may appear up
149 to 1 times. This option must not appear in combination with any
150 of the following options: exclude.
151 Override default of processing all packets stored in the capture
153 file and only send/edit packets which match the provided rule.
154 Rules can be one of:
155 S:<CIDR1>,... - Source IP must match specified IPv4/v6 CIDR(s)
158 D:<CIDR1>,... - Destination IP must match specified IPv4/v6
160 CIDR(s)
161 B:<CIDR1>,... - Both source and destination IP must match spec‐
163 ified IPv4/v6 CIDR(s)
164 E:<CIDR1>,... - Either IP must match specified IPv4/v6 CIDR(s)
166 P:<LIST> - Must be one of the listed packets where the list cor‐
168 responds to the packet number in the capture file.
169 -x P:1-5,9,15,72-
170 would process packets 1 through 5, the 9th and 15th packet, and
171 packets 72 until the end of the file
172 F:'<bpf>' - BPF filter. See the tcpdump(8) man page for syntax.
174 -X string, --exclude=string
176 Exclude any packet matching this rule. This option may appear
177 up to 1 times. This option must not appear in combination with
178 any of the following options: include.
179 Override default of processing all packets stored in the capture
181 file and only send/edit packets which do NOT match the provided
182 rule. Rules can be one of:
183 S:<CIDR1>,... - Source IP must not match specified IPv4/v6
186 CIDR(s)
187 D:<CIDR1>,... - Destination IP must not match specified IPv4/v6
189 CIDR(s)
190 B:<CIDR1>,... - Both source and destination IP must not match
192 specified IPv4/v6 CIDR(s)
193 E:<CIDR1>,... - Either IP must not match specified IPv4/v6
195 CIDR(s)
196 P:<LIST> - Must not be one of the listed packets where the list
198 corresponds to the packet number in the capture file.
199 -x P:1-5,9,15,72-
200 would skip packets 1 through 5, the 9th and 15th packet, and
201 packets 72 until the end of the file
202 -o string, --cachefile=string
204 Output cache file. This option may appear up to 1 times.
205 -i string, --pcap=string
208 Input pcap file to process. This option may appear up to 1
209 times.
210 -P string, --print-comment=string
213 Print embedded comment in the specified cache file. This option
214 may appear up to 1 times.
215 -I string, --print-info=string
218 Print basic info from the specified cache file. This option may
219 appear up to 1 times.
220 -S string, --print-stats=string
223 Print statistical information about the specified cache file.
224 This option may appear up to 1 times.
225 -s string, --services=string
228 Load services file for server ports. This option may appear up
229 to 1 times. This option must appear in combination with the
230 following options: port.
231 Uses a list of ports used by servers in the same format as of
233 /etc/services: <service_name> <port>/<protocol> # comment
234 Example: http 80/tcp
236 -N, --nonip
238 Send non-IP traffic out server interface. This option may
239 appear up to 1 times.
240 By default, non-IP traffic which can not be classified as client
242 or server is classified as "client". Specifying --nonip will
243 reclassify non-IP traffic as "server". Note that the meaning of
244 this flag is reversed if --reverse is used.
245 -R string, --ratio=string
247 Ratio of client to server packets. This option may appear up to
248 1 times. This option must appear in combination with the fol‐
249 lowing options: auto. The default string for this option is:
250 2.0
251 Since a given host may have both client and server traffic being
253 sent to/from it, tcpprep uses a ratio to weigh these packets.
254 If you would like to override the default of 2:1 server to
255 client packets required for a host to be classified as a server,
256 specify it as a floating point value.
257 -m number, --minmask=number
259 Minimum network mask length in auto mode. This option may
260 appear up to 1 times. This option must appear in combination
261 with the following options: auto. This option takes an integer
262 number as its argument. The value of number is constrained to
263 being:
264 in the range 0 through 32
265 The default number for this option is:
266 30
267 By default, auto modes use a minimum network mask length of 30
269 bits to build networks containing clients and servers. This
270 allows you to override this value. Larger values will increase
271 performance but may provide inaccurate results.
272 -M number, --maxmask=number
274 Maximum network mask length in auto mode. This option may
275 appear up to 1 times. This option must appear in combination
276 with the following options: auto. This option takes an integer
277 number as its argument. The value of number is constrained to
278 being:
279 in the range 0 through 32
280 The default number for this option is:
281 8
282 By default, auto modes use a maximum network mask length of 8
284 bits to build networks containing clients and servers. This
285 allows you to override this value. Larger values will decrease
286 performance and accuracy but will provide greater chance of suc‐
287 cess.
288 -v, --verbose
290 Print decoded packets via tcpdump to STDOUT. This option may
291 appear up to 1 times.
292 -A string, --decode=string
295 Arguments passed to tcpdump decoder. This option may appear up
296 to 1 times. This option must appear in combination with the
297 following options: verbose.
298 When enabling verbose mode (-v) you may also specify one or more
300 additional arguments to pass to tcpdump to modify the way pack‐
301 ets are decoded. By default, -n and -l are used. Be sure to
302 quote the arguments so that they are not interpreted by
303 tcprewrite. The following arguments are valid:
304 [ -aAeNqRStuvxX ]
305 [ -E spi@ipaddr algo:secret,... ]
306 [ -s snaplen ]
307 -V, --version
309 Print version information.
310 -h, --less-help
313 Display less usage information and exit.
314 This option has not been fully documented.
316 -H, --help
318 Display usage information and exit.
319 -!, --more-help
321 Pass the extended usage information through a pager.
322 --save-opts [=cfgfile]
324 Save the option state to cfgfile. The default is the last con‐
325 figuration file listed in the OPTION PRESETS section, below.
326 The command will exit after updating the config file.
327 --load-opts=cfgfile, --no-load-opts
329 Load options from cfgfile. The no-load-opts form will disable
330 the loading of earlier config/rc/ini files. --no-load-opts is
331 handled early, out of order.
332
334 Any option that is not marked as not presettable may be preset by load‐
335 ing values from configuration ("RC" or ".INI") file(s). The homerc
336 file is "$$/", unless that is a directory. In that case, the file
337 ".tcppreprc" is searched for within that directory.
338
340 See OPTION PRESETS for configuration files.
341
343 One of the following exit values will be returned:
344 0 (EXIT_SUCCESS)
346 Successful program execution.
347 1 (EXIT_FAILURE)
349 The operation failed or the command syntax was not valid.
350 66 (EX_NOINPUT)
352 A specified configuration file could not be loaded.
353 70 (EX_SOFTWARE)
355 libopts had an internal operational error. Please report it to
356 autogen-users@lists.sourceforge.net. Thank you.
357
359 Copyright 2013-2018 Fred Klassen - AppNeta Copyright 2000-2012 Aaron
360 Turner For support please use the tcpreplay-users@lists.sourceforge.net
361 mailing list. The latest version of this software is always available
362 from: http://tcpreplay.appneta.com/
363
365 Copyright (C) 2000-2018 Aaron Turner and Fred Klassen all rights
366 reserved. This program is released under the terms of the GNU General
367 Public License, version 3 or later.
368
370 Please send bug reports to: tcpreplay-users@lists.sourceforge.net
371
373 This manual page was AutoGen-erated from the tcpprep option defini‐
374 tions.
375tcpprep 12 Mar 2019 tcpprep(1)