1tcpprep(1)                       User Commands                      tcpprep(1)
2
3
4

NAME

6       tcpprep - Create a tcpreplay cache cache file from a pcap file.
7

SYNOPSIS

9       tcpprep [-flags] [-flag [value]] [--option-name[[=| ]value]]
10
11       All arguments must be options.
12
13       tcpprep  is  a  pcap(3)  file  pre-processor which creates a cache file
14       which provides "rules" for tcprewrite(1) and  tcpreplay(1)  on  how  to
15       process and send packets.
16

DESCRIPTION

18       The  basic  operation  of  tcpreplay  is to resend all packets from the
19       input file(s) out a single file.  Tcpprep processes  a  pcap  file  and
20       applies  a  set  of  user-specified  rules to create a cache file which
21       tells tcpreplay whether or not to send each packet and which  interface
22       the packet should be sent out of.
23
24       For  more  details,  please  see the Tcpreplay Manual at: http://tcpre
25       play.appneta.com
26

OPTIONS

28       -d number, --dbug=number
29              Enable debugging output.  This option may appear up to 1  times.
30              This  option takes an integer number as its argument.  The value
31              of number is constrained to being:
32                  in the range  0 through 5
33              The default number for this option is:
34                   0
35
36              If configured with --enable-debug, then you can specify a ver‐
37              bosity level for debugging output.  Higher numbers increase ver‐
38              bosity.
39
40       -a string, --auto=string
41              Auto-split mode.  This option may appear up to 1 times.  This
42              option must not appear in combination with any of the following
43              options: cidr, port, regex, mac.
44
45              Tcpprep will try to automatically determine the primary function
46              of hosts based on the traffic captured and classify each host as
47              client or server.  In order to do so, you must provide a hint to
48              tcpprep as to how to search for clients and servers.  Valid
49              hints are:
50
51
52              bridge Bridge mode processes each packet to try to determine if
53              the sender is a client or server.  Once all the packets are pro‐
54              cessed, the results are weighed according to the server/client
55              ratio (--ratio) and systems are assigned an interface.  If tcp‐
56              prep is unable to determine what role a system plays, tcpprep
57              will abort.
58
59              router Router mode works just like bridge mode, except that
60              after weighing is done, systems which are undetermined are con‐
61              sidered a server if they fall inside a network known to contain
62              other servers.  Router has a greater chance of successfully
63              splitting clients and servers but is not 100% foolproof.
64
65              client Client mode works just like bridge mode, except that
66              unclassified systems are treated as clients.  Client mode should
67              always complete successfully.
68
69              server Server mode works just like bridge mode, except that
70              unclassified systems are treated as servers.  Server mode should
71              always complete successfully.
72
73              first First mode works by looking at the first time each IP is
74              seen in the SRC and DST fields in the IP header.  If the host is
75              first seen in the SRC field, it is a client and if it's first
76              seen in the DST field, it is marked as a server.   This effec‐
77              tively replicates the processing of the tomahawk test tool.
78              First mode should always complete successfully.
79
80       -c string, --cidr=string
81              CIDR-split mode.  This option may appear up to 1 times.  This
82              option must not appear in combination with any of the following
83              options: auto, port, regex, mac.
84
85              Specify a comma delimited list of CIDR netblocks to match
86              against the source IP of each packet.  Packets matching any of
87              the CIDR's are classified as servers.
88
89              IPv4 Example:
90                  --cidr=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8
91              IPv6 Example:
92                  --cidr=[::ffff:0:0/96],[fe80::/16]
93
94       -r string, --regex=string
95              Regex-split mode.  This option may appear up to 1 times.  This
96              option must not appear in combination with any of the following
97              options: auto, port, cidr, mac.
98
99              Specify a regular expression to match against the source IP of
100              each packet.  Packets matching the regex are classified as
101              servers.
102
103       -p, --port
104              Port-split mode.  This option may appear up to 1 times.  This
105              option must not appear in combination with any of the following
106              options: auto, regex, cidr, mac.
107
108              Specifies that TCP and UDP traffic over IPv4 and IPv6 should be
109              classified as client or server based upon the destination port
110              of the header.
111
112       -e string, --mac=string
113              Source MAC split mode.  This option may appear up to 1 times.
114              This option must not appear in combination with any of the fol‐
115              lowing options: auto, regex, cidr, port.
116
117              Specify a list of MAC addresses to match against the source MAC
118              of each packet.  Packets matching one of the values are classi‐
119              fied as servers.
120
121       --reverse
122              Matches to be client instead of server.  This option may appear
123              up to 1 times.
124
125              Normally the --mac, --regex and --cidr flags specify are used to
126              specify the servers and non-IP packets are classified as
127              clients.  By using --reverse, these features are reversed so
128              that the flags specify clients and non-IP packets are classified
129              as servers.
130
131       -C string, --comment=string
132              Embedded cache file comment.  This option may appear up to 1
133              times.
134
135              Specify a comment to be imbedded within the output cache file
136              and later viewed.
137
138       --no-arg-comment
139              Do not embed any cache file comment.  This option may appear up
140              to 1 times.
141
142              By default, tcpprep includes the arguments passed on the command
143              line in the cache file comment (in addition to any user speci‐
144              fied --comment).  If for some reason you do not wish to include
145              this, specify this option.
146
147       -x string, --include=string
148              Include only packets matching rule.  This option may appear up
149              to 1 times.  This option must not appear in combination with any
150              of the following options: exclude.
151
152              Override default of processing all packets stored in the capture
153              file and only send/edit packets which match the provided rule.
154              Rules can be one of:
155
156
157              S:<CIDR1>,...  - Source IP must match specified IPv4/v6 CIDR(s)
158
159              D:<CIDR1>,...  - Destination IP must match specified IPv4/v6
160              CIDR(s)
161
162              B:<CIDR1>,...  - Both source and destination IP must match spec‐
163              ified IPv4/v6 CIDR(s)
164
165              E:<CIDR1>,...  - Either IP must match specified IPv4/v6 CIDR(s)
166
167              P:<LIST> - Must be one of the listed packets where the list cor‐
168              responds to the packet number in the capture file.
169                  -x P:1-5,9,15,72-
170              would process packets 1 through 5, the 9th and 15th packet, and
171              packets 72 until the end of the file
172
173              F:'<bpf>' - BPF filter.  See the tcpdump(8) man page for syntax.
174
175       -X string, --exclude=string
176              Exclude any packet matching this rule.  This option may appear
177              up to 1 times.  This option must not appear in combination with
178              any of the following options: include.
179
180              Override default of processing all packets stored in the capture
181              file and only send/edit packets which do NOT match the provided
182              rule.  Rules can be one of:
183
184
185              S:<CIDR1>,...  - Source IP must not match specified IPv4/v6
186              CIDR(s)
187
188              D:<CIDR1>,...  - Destination IP must not match specified IPv4/v6
189              CIDR(s)
190
191              B:<CIDR1>,...  - Both source and destination IP must not match
192              specified IPv4/v6 CIDR(s)
193
194              E:<CIDR1>,...  - Either IP must not match specified IPv4/v6
195              CIDR(s)
196
197              P:<LIST> - Must not be one of the listed packets where the list
198              corresponds to the packet number in the capture file.
199                  -x P:1-5,9,15,72-
200              would skip packets 1 through 5, the 9th and 15th packet, and
201              packets 72 until the end of the file
202
203       -o string, --cachefile=string
204              Output cache file.  This option may appear up to 1 times.
205
206
207       -i string, --pcap=string
208              Input pcap file to process.  This option may appear up to 1
209              times.
210
211
212       -P string, --print-comment=string
213              Print embedded comment in the specified cache file.  This option
214              may appear up to 1 times.
215
216
217       -I string, --print-info=string
218              Print basic info from the specified cache file.  This option may
219              appear up to 1 times.
220
221
222       -S string, --print-stats=string
223              Print statistical information about the specified cache file.
224              This option may appear up to 1 times.
225
226
227       -s string, --services=string
228              Load services file for server ports.  This option may appear up
229              to 1 times.  This option must appear in combination with the
230              following options: port.
231
232              Uses a list of ports used by servers in the same format as of
233              /etc/services: <service_name>        <port>/<protocol> # comment
234
235              Example: http            80/tcp
236
237       -N, --nonip
238              Send non-IP traffic out server interface.  This option may
239              appear up to 1 times.
240
241              By default, non-IP traffic which can not be classified as client
242              or server is classified as "client".  Specifying --nonip will
243              reclassify non-IP traffic as "server".  Note that the meaning of
244              this flag is reversed if --reverse is used.
245
246       -R string, --ratio=string
247              Ratio of client to server packets.  This option may appear up to
248              1 times.  This option must appear in combination with the fol‐
249              lowing options: auto.  The default string for this option is:
250                   2.0
251
252              Since a given host may have both client and server traffic being
253              sent to/from it, tcpprep uses a ratio to weigh these packets.
254              If you would like to override the default of 2:1 server to
255              client packets required for a host to be classified as a server,
256              specify it as a floating point value.
257
258       -m number, --minmask=number
259              Minimum network mask length in auto mode.  This option may
260              appear up to 1 times.  This option must appear in combination
261              with the following options: auto.  This option takes an integer
262              number as its argument.  The value of number is constrained to
263              being:
264                  in the range  0 through 32
265              The default number for this option is:
266                   30
267
268              By default, auto modes use a minimum network mask length of 30
269              bits to build networks containing clients and servers.  This
270              allows you to override this value.  Larger values will increase
271              performance but may provide inaccurate results.
272
273       -M number, --maxmask=number
274              Maximum network mask length in auto mode.  This option may
275              appear up to 1 times.  This option must appear in combination
276              with the following options: auto.  This option takes an integer
277              number as its argument.  The value of number is constrained to
278              being:
279                  in the range  0 through 32
280              The default number for this option is:
281                   8
282
283              By default, auto modes use a maximum network mask length of 8
284              bits to build networks containing clients and servers.  This
285              allows you to override this value.  Larger values will decrease
286              performance and accuracy but will provide greater chance of suc‐
287              cess.
288
289       -v, --verbose
290              Print decoded packets via tcpdump to STDOUT.  This option may
291              appear up to 1 times.
292
293
294       -A string, --decode=string
295              Arguments passed to tcpdump decoder.  This option may appear up
296              to 1 times.  This option must appear in combination with the
297              following options: verbose.
298
299              When enabling verbose mode (-v) you may also specify one or more
300              additional arguments to pass to tcpdump to modify the way pack‐
301              ets are decoded.  By default, -n and -l are used.  Be sure to
302              quote the arguments so that they are not interpreted by
303              tcprewrite.  The following arguments are valid:
304                  [ -aAeNqRStuvxX ]
305                  [ -E spi@ipaddr algo:secret,... ]
306                  [ -s snaplen ]
307
308       -V, --version
309              Print version information.
310
311
312       -h, --less-help
313              Display less usage information and exit.
314
315              This option has not been fully documented.
316
317       -H, --help
318              Display usage information and exit.
319
320       -!, --more-help
321              Pass the extended usage information through a pager.
322
323       --save-opts [=cfgfile]
324              Save the option state to cfgfile.  The default is the last con‐
325              figuration file listed in the OPTION PRESETS section, below.
326              The command will exit after updating the config file.
327
328       --load-opts=cfgfile, --no-load-opts
329              Load options from cfgfile.  The no-load-opts form will disable
330              the loading of earlier config/rc/ini files.  --no-load-opts is
331              handled early, out of order.
332

OPTION PRESETS

334       Any option that is not marked as not presettable may be preset by load‐
335       ing values from configuration ("RC" or ".INI") file(s).  The homerc
336       file is "$$/", unless that is a directory.  In that case, the file
337       ".tcppreprc" is searched for within that directory.
338

FILES

340       See OPTION PRESETS for configuration files.
341

EXIT STATUS

343       One of the following exit values will be returned:
344
345       0  (EXIT_SUCCESS)
346              Successful program execution.
347
348       1  (EXIT_FAILURE)
349              The operation failed or the command syntax was not valid.
350
351       66  (EX_NOINPUT)
352              A specified configuration file could not be loaded.
353
354       70  (EX_SOFTWARE)
355              libopts had an internal operational error.  Please report it to
356              autogen-users@lists.sourceforge.net.  Thank you.
357

AUTHORS

359       Copyright 2013-2018 Fred Klassen - AppNeta Copyright 2000-2012 Aaron
360       Turner For support please use the tcpreplay-users@lists.sourceforge.net
361       mailing list.  The latest version of this software is always available
362       from: http://tcpreplay.appneta.com/
363
365       Copyright (C) 2000-2018 Aaron Turner and Fred Klassen all rights
366       reserved.  This program is released under the terms of the GNU General
367       Public License, version 3 or later.
368

BUGS

370       Please send bug reports to: tcpreplay-users@lists.sourceforge.net
371

NOTES

373       This manual page was AutoGen-erated from the tcpprep option defini‐
374       tions.
375
376
377
378tcpprep                           14 Jun 2020                       tcpprep(1)
Impressum