1tcpbridge(1) User Commands tcpbridge(1)
2
6 tcpbridge - Bridge network traffic across two interfaces
7
9 tcpbridge [-flags] [-flag [value]] [--option-name[[=| ]value]]
10 All arguments must be options.
12 tcpbridge is a tool for selectively bridging network traffic across two
14 interfaces and optionally modifying the packets in between
15
17 The basic operation of tcpbridge is to be a network bridge between two
18 subnets. All packets received on one interface are sent via the other.
19 Optionally, packets can be edited in a variety of ways according to
21 your needs.
22 For more details, please see the Tcpreplay Manual at: http://tcpre‐
24 play.appneta.com
25
27 -r string, --portmap=string
29 Rewrite TCP/UDP ports. This option may appear up to 9999 times.
30 Specify a list of comma delimited port mappings consisting of
32 colon delimited port number pairs. Each colon delimited port
33 pair consists of the port to match followed by the port number
34 to rewrite.
35 Examples:
37 --portmap=80:8000 --portmap=8080:80 # 80->8000 and 8080->80
38 --portmap=8000,8080,88888:80 # 3 different ports become 80
39 --portmap=8000-8999:80 # ports 8000 to 8999 become 80
40 -s number, --seed=number
42 Randomize src/dst IPv4/v6 addresses w/ given seed. This option
43 may appear up to 1 times. This option must not appear in combi‐
44 nation with any of the following options: fuzz-seed. This op‐
45 tion takes an integer number as its argument.
46 Causes the source and destination IPv4/v6 addresses to be pseudo
48 randomized but still maintain client/server relationships.
49 Since the randomization is deterministic based on the seed, you
50 can reuse the same seed value to recreate the traffic.
51 -N string, --pnat=string
53 Rewrite IPv4/v6 addresses using pseudo-NAT. This option may ap‐
54 pear up to 2 times. This option must not appear in combination
55 with any of the following options: srcipmap.
56 Takes a comma delimited series of colon delimited CIDR netblock
58 pairs. Each netblock pair is evaluated in order against the IP
59 addresses. If the IP address in the packet matches the first
60 netblock, it is rewritten using the second netblock as a mask
61 against the high order bits.
62 IPv4 Example:
64 --pnat=192.168.0.0/16:10.77.0.0/16,172.16.0.0/12:10.1.0.0/24
65 IPv6 Example:
66 --pnat=[2001:db8::/32]:[dead::/16],[2001:db8::/32]:[::ffff:0:0/96]
67 -S string, --srcipmap=string
69 Rewrite source IPv4/v6 addresses using pseudo-NAT. This option
70 may appear up to 1 times. This option must not appear in combi‐
71 nation with any of the following options: pnat.
72 Works just like the --pnat option, but only affects the source
74 IP addresses in the IPv4/v6 header.
75 -D string, --dstipmap=string
77 Rewrite destination IPv4/v6 addresses using pseudo-NAT. This
78 option may appear up to 1 times. This option must not appear in
79 combination with any of the following options: pnat.
80 Works just like the --pnat option, but only affects the destina‐
82 tion IP addresses in the IPv4/v6 header.
83 -e string, --endpoints=string
85 Rewrite IP addresses to be between two endpoints. This option
86 may appear up to 1 times. This option must appear in combina‐
87 tion with the following options: cachefile.
88 Takes a pair of colon delimited IPv4/v6 addresses which will be
90 used to rewrite all traffic to appear to be between the two IP
91 addresses.
92 IPv4 Example:
94 --endpoints=172.16.0.1:172.16.0.2
95 IPv6 Example:
96 --endpoints=[2001:db8::dead:beef]:[::ffff:0:0:ac:f:0:2]
97 --tcp-sequence=number
99 Change TCP Sequence (and ACK) numbers /w given seed. This op‐
100 tion takes an integer number as its argument. The value of num‐
101 ber is constrained to being:
102 greater than or equal to 1
103 The default number for this option is:
104 0
105 Change all TCP sequence numbers, and related sequence-acknowl‐
107 edgement numbers. They will be shifted by a random amount based
108 on the provided seed.
109 -b, --skipbroadcast
111 Skip rewriting broadcast/multicast IPv4/v6 addresses.
112 By default --seed, --pnat and --endpoints will rewrite broadcast
114 and multicast IPv4/v6 and MAC addresses. Setting this flag will
115 keep broadcast/multicast IPv4/v6 and MAC addresses from being
116 rewritten.
117 -C, --fixcsum
119 Force recalculation of IPv4/TCP/UDP header checksums.
120 Causes each IPv4/v6 packet to have their checksums recalculated
122 and fixed. Automatically enabled for packets modified with
123 --seed, --pnat, --endpoints or --fixlen.
124 -m number, --mtu=number
126 Override default MTU length (1500 bytes). This option may ap‐
127 pear up to 1 times. This option takes an integer number as its
128 argument. The value of number is constrained to being:
129 in the range 1 through MAX_SNAPLEN
130 Override the default 1500 byte MTU size for determining the max‐
132 imum padding length (--fixlen=pad) or when truncating (--mtu-
133 trunc).
134 --mtu-trunc
136 Truncate packets larger then specified MTU. This option may ap‐
137 pear up to 1 times.
138 Similar to --fixlen, this option will truncate data in packets
140 from Layer 3 and above to be no larger then the MTU.
141 -E, --efcs
143 Remove Ethernet checksums (FCS) from end of frames.
144 Note, this option is pretty dangerous! We do not actually check
146 to see if a FCS actually exists in the frame, we just blindly
147 delete the last 4 bytes. Hence, you should only use this if you
148 know know that your OS provides the FCS when reading raw pack‐
149 ets.
150 --ttl=string
152 Modify the IPv4/v6 TTL/Hop Limit.
153 Allows you to modify the TTL/Hop Limit of all the IPv4/v6 pack‐
155 ets. Specify a number to hard-code the value or +/-value to in‐
156 crease or decrease by the value provided (limited to 1-255).
157 Examples:
159 --ttl=10
160 --ttl=+7
161 --ttl=-64
162 --tos=number
164 Set the IPv4 TOS/DiffServ/ECN byte. This option may appear up
165 to 1 times. This option takes an integer number as its argu‐
166 ment. The value of number is constrained to being:
167 in the range 0 through 255
168 Allows you to override the TOS (also known as DiffServ/ECN)
170 value in IPv4.
171 --tclass=number
173 Set the IPv6 Traffic Class byte. This option may appear up to 1
174 times. This option takes an integer number as its argument.
175 The value of number is constrained to being:
176 in the range 0 through 255
177 Allows you to override the IPv6 Traffic Class field.
179 --flowlabel=number
181 Set the IPv6 Flow Label. This option may appear up to 1 times.
182 This option takes an integer number as its argument. The value
183 of number is constrained to being:
184 in the range 0 through 1048575
185 Allows you to override the 20bit IPv6 Flow Label field. Has no
187 effect on IPv4 packets.
188 -F string, --fixlen=string
190 Pad or truncate packet data to match header length. This option
191 may appear up to 1 times.
192 Packets may be truncated during capture if the snaplen is
194 smaller then the packet. This option allows you to modify the
195 packet to pad the packet back out to the size stored in the
196 IPv4/v6 header or rewrite the IP header total length to reflect
197 the stored packet length.
198 pad Truncated packets will be padded out so that the packet
200 length matches the IPv4 total length
201 trunc Truncated packets will have their IPv4 total length field
203 rewritten to match the actual packet length
204 del Delete the packet
206 --fuzz-seed=number
208 Fuzz 1 in X packets. Edit bytes, length, or emulate packet drop.
209 This option takes an integer number as its argument. The value
210 of number is constrained to being:
211 greater than or equal to 0
212 The default number for this option is:
213 0
214 This fuzzing was designed as to test layer 7 protocols such as
216 voip protocols. It modifies randomly 1 out of X packets (where
217 X = --fuzz-factor) in order for stateful protocols to cover more
218 of their code. The random fuzzing actions focus on data start
219 and end because it often is the part of the data application
220 protocols base their decisions on.
221 Possible fuzzing actions list:
223 * drop packet
224 * reduce packet size
225 * edit packet Bytes:
226 * Not all Bytes have the same probability of appearance in
227 real life.
228 Replace with 0x00, 0xFF, or a random byte with equal like‐
229 lihood.
230 * Not all Bytes have the same significance in a packet.
231 Replace the start, the end, or the middle of the packet
232 with equal likelihood.
233 * do nothing (7 out of 8 packets)
234 --fuzz-factor=number
236 Set the Fuzz 1 in X packet ratio (default 1 in 8 packets). This
237 option must appear in combination with the following options:
238 fuzz-seed. This option takes an integer number as its argument.
239 The value of number is constrained to being:
240 greater than or equal to 1
241 The default number for this option is:
242 8
243 Sets the ratio of for --fuzz-seed option. By default this value
245 is 8, which means 1 in 8 packets are modified by fuzzing. Note
246 that this ratio is based on the random number generated by the
247 supplied fuzz seed. Therefore by default you cannot expect that
248 exactly every eighth packet will be modified.
249 --skipl2broadcast
251 Skip rewriting broadcast/multicast Layer 2 addresses.
252 By default, editing Layer 2 addresses will rewrite broadcast and
254 multicast MAC addresses. Setting this flag will keep broad‐
255 cast/multicast MAC addresses from being rewritten.
256 --dlt=string
258 Override output DLT encapsulation. This option may appear up to
259 1 times.
260 By default, no DLT (data link type) conversion will be made. To
262 change the DLT type of the output pcap, select one of the fol‐
263 lowing values:
264 enet Ethernet aka DLT_EN10MB
266 hdlc Cisco HDLC aka DLT_C_HDLC
268 jnpr_eth Juniper Ethernet DLT_C_JNPR_ETHER
270 pppserial PPP Serial aka DLT_PPP_SERIAL
272 user User specified Layer 2 header and DLT type
274 --enet-dmac=string
276 Override destination ethernet MAC addresses. This option may
277 appear up to 1 times.
278 Takes a pair of comma deliminated ethernet MAC addresses which
280 will replace the destination MAC address of outbound packets.
281 The first MAC address will be used for the server to client
282 traffic and the optional second MAC address will be used for the
283 client to server traffic.
284 Example:
286 --enet-dmac=00:12:13:14:15:16,00:22:33:44:55:66
287 --enet-smac=string
289 Override source ethernet MAC addresses. This option may appear
290 up to 1 times.
291 Takes a pair of comma deliminated ethernet MAC addresses which
293 will replace the source MAC address of outbound packets. The
294 first MAC address will be used for the server to client traffic
295 and the optional second MAC address will be used for the client
296 to server traffic.
297 Example:
299 --enet-smac=00:12:13:14:15:16,00:22:33:44:55:66
300 --enet-subsmac=string
302 Substitute MAC addresses. This option may appear up to 9999
303 times.
304 Allows you to rewrite ethernet MAC addresses of packets. It
306 takes comma delimited pair or MACs address and rewrites all oc‐
307 currences of the first MAC with the value of the second MAC.
308 Example:
309 --enet-subsmac=00:12:13:14:15:16,00:22:33:44:55:66
310 --enet-mac-seed=number
312 Randomize MAC addresses. This option may appear up to 1 times.
313 This option must not appear in combination with any of the fol‐
314 lowing options: enet-smac, enet-dmac, enet-subsmac. This option
315 takes an integer number as its argument.
316 Allows you to randomize ethernet MAC addresses of packets,
318 mostly like what --seed option does for IPv4/IPv6 addresses.
319 --enet-mac-seed-keep-bytes=number
321 Randomize MAC addresses. This option may appear up to 1 times.
322 This option must appear in combination with the following op‐
323 tions: enet-mac-seed. This option takes an integer number as
324 its argument. The value of number is constrained to being:
325 in the range 1 through 6
326 Keep some bytes untouched when usinging --enet-mac-seed option.
328 --enet-vlan=string
330 Specify ethernet 802.1q VLAN tag mode. This option may appear
331 up to 1 times.
332 Allows you to rewrite ethernet frames to add a 802.1q header to
334 standard 802.3 ethernet headers or remove the 802.1q VLAN tag
335 information.
336 add Adds an 802.1q VLAN header to the existing 802.3 ethernet
338 header. If a VLAN header already exists, a new VLAN header is
339 added outside of the existing header.
340 Note that you will be allowed to run this option multiple times
342 to create more than 2 VLAN headers, however those packets will
343 be valid. At most you should have 2 X 802.1q VLAN tags, or outer
344 an 802.1ad and an inner 802.1q VLAN tag.
345 del Rewrites the existing 802.1q VLAN header as an 802.3 ether‐
347 net header
348 --enet-vlan-tag=number
350 Specify the new ethernet 802.1q VLAN tag value. This option may
351 appear up to 1 times. This option must appear in combination
352 with the following options: enet-vlan. This option takes an in‐
353 teger number as its argument. The value of number is con‐
354 strained to being:
355 in the range 0 through 4095
356 --enet-vlan-cfi=number
359 Specify the ethernet 802.1q VLAN CFI value. This option may ap‐
360 pear up to 1 times. This option must appear in combination with
361 the following options: enet-vlan. This option takes an integer
362 number as its argument. The value of number is constrained to
363 being:
364 in the range 0 through 1
365 --enet-vlan-pri=number
368 Specify the ethernet 802.1q VLAN priority. This option may ap‐
369 pear up to 1 times. This option must appear in combination with
370 the following options: enet-vlan. This option takes an integer
371 number as its argument. The value of number is constrained to
372 being:
373 in the range 0 through 7
374 --enet-vlan-proto=string
377 Specify VLAN tag protocol 802.1q or 802.1ad. This option may
378 appear up to 1 times.
379 Allows you to specify the protocol of the added VLAN tags.
381 802.1q Specifies that 802.1q VLAN headers are to be added. This
383 is the default.
384 802.1ad Specifies that 802.1ad Q-in-Q VLAN headers are to be
386 added. To make valid packets, input packets must already have
387 802.1q VLAN headers.
388 --hdlc-control=number
390 Specify HDLC control value. This option may appear up to 1
391 times. This option takes an integer number as its argument.
392 The Cisco HDLC header has a 1 byte "control" field. Apparently
394 this should always be 0, but if you can use any 1 byte value.
395 --hdlc-address=number
397 Specify HDLC address. This option may appear up to 1 times.
398 This option takes an integer number as its argument.
399 The Cisco HDLC header has a 1 byte "address" field which has two
401 valid values:
402 0x0F Unicast
404 0xBF Broadcast
406 You can however specify any single byte value.
407 --user-dlt=number
409 Set output file DLT type. This option may appear up to 1 times.
410 This option takes an integer number as its argument.
411 Set the DLT value of the output pcap file.
413 --user-dlink=string
415 Rewrite Data-Link layer with user specified data. This option
416 may appear up to 2 times.
417 Provide a series of comma deliminated hex values which will be
419 used to rewrite or create the Layer 2 header of the packets.
420 The first instance of this argument will rewrite both server and
421 client traffic, but if this argument is specified a second time,
422 it will be used for the client traffic.
423 Example:
425 --user-dlink=01,02,03,04,05,06,00,1A,2B,3C,4D,5E,6F,08,00
426 -d number, --dbug=number
428 Enable debugging output. This option may appear up to 1 times.
429 This option takes an integer number as its argument. The value
430 of number is constrained to being:
431 in the range 0 through 5
432 The default number for this option is:
433 0
434 If configured with --enable-debug, then you can specify a ver‐
436 bosity level for debugging output. Higher numbers increase ver‐
437 bosity.
438 -i string, --intf1=string
440 Primary interface (listen in uni-directional mode). This option
441 may appear up to 1 times.
442 -I string, --intf2=string
445 Secondary interface (send in uni-directional mode). This option
446 may appear up to 1 times.
447 -u, --unidir
450 Send and receive in only one direction. This option may appear
451 up to 1 times.
452 Normally, tcpbridge will send and receive traffic in both direc‐
454 tions (bi-directionally). However, if you choose this option,
455 traffic will be sent uni-directionally.
456 --listnics
458 List available network interfaces and exit.
459 -L number, --limit=number
462 Limit the number of packets to send. This option may appear up
463 to 1 times. This option takes an integer number as its argu‐
464 ment. The value of number is constrained to being:
465 greater than or equal to 1
466 The default number for this option is:
467 -1
468 By default, tcpbridge will send packets forever or until Ctrl-C.
470 Alternatively, you can specify a maximum number of packets to
471 send.
472 -M string, --mac=string
474 MAC addresses of local NIC's. This option may appear up to 2
475 times.
476 tcpbridge does not support detecting the MAC addresses of the
478 local network interfaces under Windows. Please specify both MAC
479 addresses of the interfaces used in the bridge: -M <intf1 mac>
480 -M <intf2 mac>
481 -x string, --include=string
483 Include only packets matching rule. This option may appear up
484 to 1 times. This option must not appear in combination with any
485 of the following options: exclude.
486 Override default of sending all packets stored in the capture
488 file and only send packets which match the provided rule. Rules
489 can be one of:
490 S:<CIDR1>,... - Source IP must match specified CIDR(s)
493 D:<CIDR1>,... - Destination IP must match specified CIDR(s)
495 B:<CIDR1>,... - Both source and destination IP must match spec‐
497 ified CIDR(s)
498 E:<CIDR1>,... - Either IP must match specified CIDR(s)
500 P:<LIST> - Must be one of the listed packets where the list cor‐
502 responds to the packet number in the capture file.
503 --include=P:1-5,9,15,72-
504 would send packets 1 through 5, the 9th and 15th packet, and
505 packets 72 until the end of the file
506 F:'<bpf>' - BPF filter. See the tcpdump(8) man page for syntax.
508 -X string, --exclude=string
510 Exclude any packet matching this rule. This option may appear
511 up to 1 times. This option must not appear in combination with
512 any of the following options: include.
513 Override default of sending all packets stored in the capture
515 file and only send packets which do not match the provided rule.
516 Rules can be one of:
517 S:<CIDR1>,... - Source IP must not match specified CIDR(s)
520 D:<CIDR1>,... - Destination IP must not match specified CIDR(s)
522 B:<CIDR1>,... - Both source and destination IP must not match
524 specified CIDR(s)
525 E:<CIDR1>,... - Either IP must not match specified CIDR(s)
527 P:<LIST> - Must not be one of the listed packets where the list
529 corresponds to the packet number in the capture file.
530 --exclude=P:1-5,9,15,72-
531 would drop packets 1 through 5, the 9th and 15th packet, and
532 packets 72 until the end of the file
533 -P, --pid
535 Print the PID of tcpbridge at startup.
536 -v, --verbose
539 Print decoded packets via tcpdump to STDOUT. This option may
540 appear up to 1 times.
541 -A string, --decode=string
544 Arguments passed to tcpdump decoder. This option may appear up
545 to 1 times. This option must appear in combination with the
546 following options: verbose.
547 When enabling verbose mode (-v) you may also specify one or more
549 additional arguments to pass to tcpdump to modify the way pack‐
550 ets are decoded. By default, -n and -l are used. Be sure to
551 quote the arguments like: --verbose="-axxx" so that they are not
552 interpreted by tcpbridge. The following arguments are valid:
553 [ -aAeNqRStuvxX ]
554 [ -E spi@ipaddr algo:secret,... ]
555 [ -s snaplen ]
556 -V, --version
558 Print version information.
559 -h, --less-help
562 Display less usage information and exit.
563 -H, --help
566 Display usage information and exit.
567 -!, --more-help
569 Pass the extended usage information through a pager.
570 --save-opts [=cfgfile]
572 Save the option state to cfgfile. The default is the last con‐
573 figuration file listed in the OPTION PRESETS section, below.
574 The command will exit after updating the config file.
575 --load-opts=cfgfile, --no-load-opts
577 Load options from cfgfile. The no-load-opts form will disable
578 the loading of earlier config/rc/ini files. --no-load-opts is
579 handled early, out of order.
580
582 Any option that is not marked as not presettable may be preset by load‐
583 ing values from configuration ("RC" or ".INI") file(s). The homerc
584 file is "$$/", unless that is a directory. In that case, the file
585 ".tcpbridgerc" is searched for within that directory.
586
588 See OPTION PRESETS for configuration files.
589
591 One of the following exit values will be returned:
592 0 (EXIT_SUCCESS)
594 Successful program execution.
595 1 (EXIT_FAILURE)
597 The operation failed or the command syntax was not valid.
598 66 (EX_NOINPUT)
600 A specified configuration file could not be loaded.
601 70 (EX_SOFTWARE)
603 libopts had an internal operational error. Please report it to
604 autogen-users@lists.sourceforge.net. Thank you.
605
607 Copyright 2013-2022 Fred Klassen - AppNeta Copyright 2000-2012 Aaron
608 Turner For support please use the tcpreplay-users@lists.sourceforge.net
609 mailing list. The latest version of this software is always available
610 from: http://tcpreplay.appneta.com/
611
613 Copyright (C) 2000-2022 Aaron Turner and Fred Klassen all rights re‐
614 served. This program is released under the terms of the GNU General
615 Public License, version 3 or later.
616
618 Please send bug reports to: tcpreplay-users@lists.sourceforge.net
619
621 This manual page was AutoGen-erated from the tcpbridge option defini‐
622 tions.
623tcpbridge 11 Jun 2023 tcpbridge(1)