Telnet:
Using the interactive mode requires starting mausezahn as a
server:
# mausezahn -x
Now you can telnet(1) to that server using the default port
number 25542, but also an arbitrary port number can be specified:
# mausezahn -x 99
mausezahn accepts incoming telnet connections on port 99.
mz: Problems opening config file. Will use defaults
Either from another terminal or from another host try to telnet
to the mausezahn server:
caprica$ telnet galactica 99
Trying 192.168.0.4...
Connected to galactica.
Escape character is '^]'.
mausezahn <version>
Username: mz
Password: mz
mz> enable
Password: mops
mz#
It is recommended to configure your own login credentials in
/etc/netsniff-ng/mausezahn.conf, (see configuration file section)
Basics:
Since you reached the mausezahn prompt, lets try some common
commands. You can use the '?' character at any time for context-
specific help. Note that Cisco-like short form of commands are
accepted in interactive mode. For example, one can use "sh pac"
instead of "show packet"; another common example is to use
"config t" in place of "configure terminal". For readability,
this manual will continue with the full commands.
First try out the show command:
mz# show ?
mausezahn maintains its own ARP table and observes anomalies.
There is an entry for every physical interface (however this host
has only one):
mz# show arp
Intf Index IP address MAC address last
Ch UCast BCast Info
----------------------------------------------------------------------------------
eth0 [1] D 192.168.0.1 00:09:5b:9a:15:84 23:44:41
1 1 0 0000
The column Ch tells us that the announced MAC address has only
changed one time (= when it was learned). The columns Ucast and
BCast tell us how often this entry was announced via unicast or
broadcast respectively.
Let's check our interfaces:
mz# show interface
Available network interfaces:
real real used
(fake) used (fake)
device IPv4 address MAC address IPv4
address MAC address
---------------------------------------------------------------------------------------
> eth0 192.168.0.4 00:30:05:76:2e:8d
192.168.0.4 00:30:05:76:2e:8d
lo 127.0.0.1 00:00:00:00:00:00 127.0.0.1
00:00:00:00:00:00
2 interfaces found.
Default interface is eth0.
Defining packets:
Let's check the current packet list:
mz# show packet
Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS,
I/i=IP/delivery_off, U=UDP, T=TCP
PktID PktName Layers Proto Size State
Device Delay Count/CntX
1 sysARP_servic... E----- ARP 60 config lo
100 msec 1/0 (100%)
1 packets defined, 0 active.
We notice that there is already one system-defined packet
process; it has been created and used only once (during startup)
by mausezahn's ARP service. Currently, its state is config which
means that the process is sleeping.
General packet options:
Now let's create our own packet process and switch into the
global configuration mode:
mz# configure terminal
mz(config)# packet
Allocated new packet PKT0002 at slot 2
mz(config-pkt-2)# ?
...
name Assign a unique name
description Assign a packet description text
bind Select the network interface
count Configure the packet count value
delay Configure the inter-packet delay
interval Configure a greater interval
type Specify packet type
mac Configure packet's MAC addresses
tag Configure tags
payload Configure a payload
port Configure packet's port numbers
end End packet configuration mode
ethernet Configure frame's Ethernet, 802.2, 802.3,
or SNAP settings
ip Configure packet's IP settings
udp Configure packet's UDP header parameters
tcp Configure packet's TCP header parameters
Here are a lot of options but normally you only need a few of
them. When you configure lots of different packets you might
assign a reasonable name and description for them:
mz(config-pkt-2)# name Test
mz(config-pkt-2)# description This is just a test
You can, for example, change the default settings for the source
and destination MAC or IP addresses using the mac and ip
commands:
mz(config-pkt-2)# ip address destination 10.1.1.0 /24
mz(config-pkt-2)# ip address source random
In the example above, we configured a range of addresses (all
hosts in the network 10.1.1.0 should be addressed). Additionally
we spoof our source IP address. Of course, we can also add one or
more VLAN and, or, MPLS tag(s):
mz(config-pkt-2)# tag ?
dot1q Configure 802.1Q (and 802.1P) parameters
mpls Configure MPLS label stack
mz(config-pkt-2)# tag dot ?
Configure 802.1Q tags:
VLAN[:CoS] [VLAN[:CoS]] ... The leftmost tag is the outer tag
in the frame
remove <tag-nr> | all Remove one or more tags (<tag-nr>
starts with 1),
by default the first
(=leftmost,outer) tag is removed,
keyword 'all' can be used instead
of tag numbers.
cfi | nocfi [<tag-nr>] Set or unset the CFI-bit in any
tag (by default
assuming the first tag).
mz(config-pkt-2)# tag dot 1:7 200:5
Configure count and delay:
mz(config-pkt-2)# count 1000
mz(config-pkt-2)# delay ?
delay <value> [hour | min | sec | msec | usec | nsec]
Specify the inter-packet delay in hours, minutes, seconds,
milliseconds, microseconds or nanoseconds. The default unit is
milliseconds (i.e. when no unit is given).
mz(config-pkt-2)# delay 1 msec
Inter-packet delay set to 0 sec and 1000000 nsec
mz(config-pkt-2)#
Configuring protocol types:
mausezahn's interactive mode supports a growing list of protocols
and only relies on the MOPS architecture (and not on libnet as is
the case with the legacy direct mode):
mz(config-pkt-2)# type
Specify a packet type from the following list:
arp
bpdu
igmp
ip
lldp
tcp
udp
mz(config-pkt-2)# type tcp
mz(config-pkt-2-tcp)#
....
seqnr Configure the TCP sequence number
acknr Configure the TCP acknowledgement number
hlen Configure the TCP header length
reserved Configure the TCP reserved field
flags Configure a combination of TCP flags at
once
cwr Set or unset the TCP CWR flag
ece Set or unset the TCP ECE flag
urg Set or unset the TCP URG flag
ack set or unset the TCP ACK flag
psh set or unset the TCP PSH flag
rst set or unset the TCP RST flag
syn set or unset the TCP SYN flag
fin set or unset the TCP FIN flag
window Configure the TCP window size
checksum Configure the TCP checksum
urgent-pointer Configure the TCP urgent pointer
options Configure TCP options
end End TCP configuration mode
mz(config-pkt-2-tcp)# flags syn fin rst
Current setting is: --------------------RST-SYN-FIN
mz(config-pkt-2-tcp)# end
mz(config-pkt-2)# payload ascii This is a dummy payload for my
first packet
mz(config-pkt-2)# end
Now configure another packet, for example let's assume we want an
LLDP process:
mz(config)# packet
Allocated new packet PKT0003 at slot 3
mz(config-pkt-3)# type lldp
mz(config-pkt-3-lldp)# exit
mz(config)# exit
In the above example we only use the default LLDP settings and
don't configure further LLDP options or TLVs. Back in the top
level of the CLI let's verify what we had done:
mz# show packet
Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS,
I/i=IP/delivery_off, U=UDP, T=TCP
PktID PktName Layers Proto Size State
Device Delay Count/CntX
1 sysARP_servic... E----- ARP 60 config lo
100 msec 1/0 (100%)
2 Test E-Q-IT 125 config
eth0 1000 usec 1000/1000 (0%)
3 PKT0003 E----- LLDP 36 config
eth0 30 sec 0/0 (0%)
3 packets defined, 0 active.
The column Layers indicates which major protocols have been
combined. For example the packet with packet-id 2 ("Test")
utilizes Ethernet (E), IP (I), and TCP (T). Additionally an
802.1Q tag (Q) has been inserted. Now start one of these packet
processes:
mz# start slot 3
Activate [3]
mz# show packet
Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS,
I/i=IP/delivery_off, U=UDP, T=TCP
PktID PktName Layers Proto Size State
Device Delay Count/CntX
1 sysARP_servic... E----- ARP 60 config lo
100 msec 1/0 (100%)
2 Test E-Q-IT 125 config
eth0 1000 usec 1000/1000 (0%)
3 PKT0003 E----- LLDP 36 config
eth0 30 sec 0/1 (0%)
3 packets defined, 1 active.
Let's have a more detailed look at a specific packet process:
mz# show packet 2
Packet [2] Test
Description: This is just a test
State: config, Count=1000, delay=1000 usec (0 s 1000000 nsec),
interval= (undefined)
Headers:
Ethernet: 00-30-05-76-2e-8d => ff-ff-ff-ff-ff-ff [0800 after
802.1Q tag]
Auto-delivery is ON (that is, the actual MAC is adapted upon
transmission)
802.1Q: 0 tag(s); (VLAN:CoS)
IP: SA=192.168.0.4 (not random) (no range)
DA=255.255.255.255 (no range)
ToS=0x00 proto=17 TTL=255 ID=0 offset=0 flags: -|-|-
len=49664(correct) checksum=0x2e8d(correct)
TCP: 83 bytes segment size (including TCP header)
SP=0 (norange) (not random), DP=0 (norange) (not random)
SQNR=3405691582 (start 0, stop 4294967295, delta 0) --
ACKNR=0 (invalid)
Flags: ------------------------SYN----, reserved field is
00, urgent pointer= 0
Announced window size= 100
Offset= 0 (times 32 bit; value is valid), checksum= ffff
(valid)
(No TCP options attached) - 0 bytes defined
Payload size: 43 bytes
Frame size: 125 bytes
1 ff:ff:ff:ff:ff:ff:00:30 05:76:2e:8d:81:00:e0:01
81:00:a0:c8:08:00:45:00 00:67:00:00:00:00:ff:06
33 fa:e4:c0:a8:00:04:ff:ff ff:ff:00:00:00:00:ca:fe
ba:be:00:00:00:00:a0:07 00:64:f7:ab:00:00:02:04
65 05:ac:04:02:08:0a:19:35 90:c3:00:00:00:00:01:03
03:05:54:68:69:73:20:69 73:20:61:20:64:75:6d:6d
97 79:20:70:61:79:6c:6f:61 64:20:66:6f:72:20:6d:79
20:66:69:72:73:74:20:70 61:63:6b:65:74
mz#
If you want to stop one or more packet processes, use the stop
command. The "emergency stop" is when you use stop all:
mz# stop all
Stopping
[3] PKT0003
Stopped 1 transmission processe(s)
The launch command provides a shortcut for commonly used packet
processes. For example to behave like a STP-capable bridge we
want to start an BPDU process with typical parameters:
mz# launch bpdu
Allocated new packet sysBPDU at slot 5
mz# show packet
Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS,
I/i=IP/delivery_off, U=UDP, T=TCP
PktID PktName Layers Proto Size State
Device Delay Count/CntX
1 sysARP_servic... E----- ARP 60 config lo
100 msec 1/0 (100%)
2 Test E-Q-IT 125 config eth0
1000 usec 1000/1000 (0%)
3 PKT0003 E----- LLDP 36 config eth0
30 sec 0/12 (0%)
4 PKT0004 E---I- IGMP 46 config eth0
100 msec 0/0 (0%)
5 sysBPDU ES---- BPDU 29 active eth0
2 sec 0/1 (0%)
5 packets defined, 1 active.
Now a Configuration BPDU is sent every 2 seconds, claiming to be
the root bridge (and usually confusing the LAN. Note that only
packet 5 (i.e. the last row) is active and therefore sending
packets while all other packets are in state config (i.e. they
have been configured but they are not doing anything at the
moment).
Configuring a greater interval:
Sometimes you may want to send a burst of packets at a greater
interval:
mz(config)# packet 2
Modify packet parameters for packet Test [2]
mz(config-pkt-2)# interval
Configure a greater packet interval in days, hours, minutes, or
seconds
Arguments: <value> <days | hours | minutes | seconds>
Use a zero value to disable an interval.
mz(config-pkt-2)# interval 1 hour
mz(config-pkt-2)# count 10
mz(config-pkt-2)# delay 15 usec
Inter-packet delay set to 0 sec and 15000 nsec
Now this packet is sent ten times with an inter-packet delay of
15 microseconds and this is repeated every hour. When you look at
the packet list, an interval is indicated with the additional
flag 'i' when inactive or 'I' when active:
mz# show packet
Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS,
I/i=IP/delivery_off, U=UDP, T=TCP
PktID PktName Layers Proto Size State
Device Delay Count/CntX
1 sysARP_servic... E----- ARP 60 config lo
100 msec 1/0 (100%)
2 Test E-Q-IT 125 config-i eth0
15 usec 10/10 (0%)
3 PKT0003 E----- LLDP 36 config eth0
30 sec 0/12 (0%)
4 PKT0004 E---I- IGMP 46 config eth0
100 msec 0/0 (0%)
5 sysBPDU ES---- BPDU 29 active eth0
2 sec 0/251 (0%)
5 packets defined, 1 active.
mz# start slot 2
Activate [2]
mz# show packet
Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS,
I/i=IP/delivery_off, U=UDP, T=TCP
PktID PktName Layers Proto Size State
Device Delay Count/CntX
1 sysARP_servic... E----- ARP 60 config lo
100 msec 1/0 (100%)
2 Test E-Q-IT 125 config+I eth0
15 usec 10/0 (100%)
3 PKT0003 E----- LLDP 36 config eth0
30 sec 0/12 (0%)
4 PKT0004 E---I- IGMP 46 config eth0
100 msec 0/0 (0%)
5 sysBPDU ES---- BPDU 29 active eth0
2 sec 0/256 (0%)
5 packets defined, 1 active.
Note that the flag 'I' indicates that an interval has been
specified for packet 2. The process is not active at the moment
(only packet 5 is active here) but it will become active at a
regular interval. You can verify the actual interval when viewing
the packet details via the 'show packet 2' command.
Load prepared configurations:
You can prepare packet configurations using the same commands as
you would type them in on the CLI and then load them to the CLI.
For example, assume we have prepared a file 'test.mops'
containing:
configure terminal
packet
name IGMP_TEST
desc This is only a demonstration how to load a file to mops
type igmp
Then we can add this packet configuration to our packet list
using the load command:
mz# load test.mops
Read commands from test.mops...
Allocated new packet PKT0002 at slot 2
mz# show packet
Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS,
I/i=IP/delivery_off, U=UDP, T=TCP
PktID PktName Layers Proto Size State
Device Delay Count/CntX
1 sysARP_servic... E----- ARP 60 config lo
100 msec 1/0 (100%)
2 IGMP_TEST E---I- IGMP 46 config eth0
100 msec 0/0 (0%)
2 packets defined, 0 active.
The file src/examples/mausezahn/example_lldp.conf contains
another example list of commands to create a bogus LLDP packet.
You can load this configuration from the mausezahn command line
as follows:
mz# load /home/hh/tmp/example_lldp.conf
In case you copied the file in that path. Now when you enter
'show packet' you will see a new packet entry in the packet list.
Use the 'start slot <nr>' command to activate this packet.
You can store your own packet creations in such a file and easily
load them when you need them. Every command within such
configuration files is executed on the command line interface as
if you had typed it in -- so be careful about the order and don't
forget to use 'configure terminal' as first command.
You can even load other files from within a central config file.
