`mausezahn` ( 8 )

быстрый универсальный генератор пакетов с Cisco-cli (a fast versatile packet generator with Cisco-cli)

INTERACTIVE MODE HOWTO

Формат

Telnet: Using the interactive mode requires starting mausezahn as a server:

# mausezahn -x

Now you can telnet(1) to that server using the default port number 25542, but also an arbitrary port number can be specified:

# mausezahn -x 99 mausezahn accepts incoming telnet connections on port 99. mz: Problems opening config file. Will use defaults

Either from another terminal or from another host try to telnet to the mausezahn server:

caprica$ telnet galactica 99 Trying 192.168.0.4... Connected to galactica. Escape character is '^]'. mausezahn <version>

Username: mz Password: mz

mz> enable Password: mops mz#

It is recommended to configure your own login credentials in /etc/netsniff-ng/mausezahn.conf, (see configuration file section)

Basics: Since you reached the mausezahn prompt, lets try some common commands. You can use the '?' character at any time for context- specific help. Note that Cisco-like short form of commands are accepted in interactive mode. For example, one can use "sh pac" instead of "show packet"; another common example is to use "config t" in place of "configure terminal". For readability, this manual will continue with the full commands.

First try out the show command:

mz# show ?

mausezahn maintains its own ARP table and observes anomalies. There is an entry for every physical interface (however this host has only one):

mz# show arp Intf Index IP address MAC address last Ch UCast BCast Info ---------------------------------------------------------------------------------- eth0 [1] D 192.168.0.1 00:09:5b:9a:15:84 23:44:41 1 1 0 0000

The column Ch tells us that the announced MAC address has only changed one time (= when it was learned). The columns Ucast and BCast tell us how often this entry was announced via unicast or broadcast respectively.

Let's check our interfaces:

mz# show interface Available network interfaces: real real used (fake) used (fake) device IPv4 address MAC address IPv4 address MAC address --------------------------------------------------------------------------------------- > eth0 192.168.0.4 00:30:05:76:2e:8d 192.168.0.4 00:30:05:76:2e:8d lo 127.0.0.1 00:00:00:00:00:00 127.0.0.1 00:00:00:00:00:00 2 interfaces found. Default interface is eth0.

Defining packets: Let's check the current packet list:

We notice that there is already one system-defined packet process; it has been created and used only once (during startup) by mausezahn's ARP service. Currently, its state is config which means that the process is sleeping.

General packet options: Now let's create our own packet process and switch into the global configuration mode:

mz# configure terminal mz(config)# packet Allocated new packet PKT0002 at slot 2 mz(config-pkt-2)# ? ... name Assign a unique name description Assign a packet description text bind Select the network interface count Configure the packet count value delay Configure the inter-packet delay interval Configure a greater interval type Specify packet type mac Configure packet's MAC addresses tag Configure tags payload Configure a payload port Configure packet's port numbers end End packet configuration mode ethernet Configure frame's Ethernet, 802.2, 802.3, or SNAP settings ip Configure packet's IP settings udp Configure packet's UDP header parameters tcp Configure packet's TCP header parameters

Here are a lot of options but normally you only need a few of them. When you configure lots of different packets you might assign a reasonable name and description for them:

mz(config-pkt-2)# name Test mz(config-pkt-2)# description This is just a test

You can, for example, change the default settings for the source and destination MAC or IP addresses using the mac and ip commands:

mz(config-pkt-2)# ip address destination 10.1.1.0 /24 mz(config-pkt-2)# ip address source random

In the example above, we configured a range of addresses (all hosts in the network 10.1.1.0 should be addressed). Additionally we spoof our source IP address. Of course, we can also add one or more VLAN and, or, MPLS tag(s):

mz(config-pkt-2)# tag ? dot1q Configure 802.1Q (and 802.1P) parameters mpls Configure MPLS label stack mz(config-pkt-2)# tag dot ? Configure 802.1Q tags: VLAN[:CoS] [VLAN[:CoS]] ... The leftmost tag is the outer tag in the frame remove <tag-nr> | all Remove one or more tags (<tag-nr> starts with 1), by default the first (=leftmost,outer) tag is removed, keyword 'all' can be used instead of tag numbers. cfi | nocfi [<tag-nr>] Set or unset the CFI-bit in any tag (by default assuming the first tag). mz(config-pkt-2)# tag dot 1:7 200:5

Specify the inter-packet delay in hours, minutes, seconds, milliseconds, microseconds or nanoseconds. The default unit is milliseconds (i.e. when no unit is given).

mz(config-pkt-2)# delay 1 msec Inter-packet delay set to 0 sec and 1000000 nsec mz(config-pkt-2)#

Configuring protocol types: mausezahn's interactive mode supports a growing list of protocols and only relies on the MOPS architecture (and not on libnet as is the case with the legacy direct mode):

mz(config-pkt-2)# type Specify a packet type from the following list: arp bpdu igmp ip lldp tcp udp mz(config-pkt-2)# type tcp mz(config-pkt-2-tcp)# .... seqnr Configure the TCP sequence number acknr Configure the TCP acknowledgement number hlen Configure the TCP header length reserved Configure the TCP reserved field flags Configure a combination of TCP flags at once cwr Set or unset the TCP CWR flag ece Set or unset the TCP ECE flag urg Set or unset the TCP URG flag ack set or unset the TCP ACK flag psh set or unset the TCP PSH flag rst set or unset the TCP RST flag syn set or unset the TCP SYN flag fin set or unset the TCP FIN flag window Configure the TCP window size checksum Configure the TCP checksum urgent-pointer Configure the TCP urgent pointer options Configure TCP options end End TCP configuration mode mz(config-pkt-2-tcp)# flags syn fin rst Current setting is: --------------------RST-SYN-FIN mz(config-pkt-2-tcp)# end mz(config-pkt-2)# payload ascii This is a dummy payload for my first packet mz(config-pkt-2)# end

Now configure another packet, for example let's assume we want an LLDP process:

mz(config)# packet Allocated new packet PKT0003 at slot 3 mz(config-pkt-3)# type lldp mz(config-pkt-3-lldp)# exit mz(config)# exit

In the above example we only use the default LLDP settings and don't configure further LLDP options or TLVs. Back in the top level of the CLI let's verify what we had done:

The column Layers indicates which major protocols have been combined. For example the packet with packet-id 2 ("Test") utilizes Ethernet (E), IP (I), and TCP (T). Additionally an 802.1Q tag (Q) has been inserted. Now start one of these packet processes:

mz# start slot 3 Activate [3] mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config eth0 1000 usec 1000/1000 (0%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/1 (0%) 3 packets defined, 1 active.

Let's have a more detailed look at a specific packet process:

mz# show packet 2 Packet [2] Test Description: This is just a test State: config, Count=1000, delay=1000 usec (0 s 1000000 nsec), interval= (undefined) Headers: Ethernet: 00-30-05-76-2e-8d => ff-ff-ff-ff-ff-ff [0800 after 802.1Q tag] Auto-delivery is ON (that is, the actual MAC is adapted upon transmission) 802.1Q: 0 tag(s); (VLAN:CoS) IP: SA=192.168.0.4 (not random) (no range) DA=255.255.255.255 (no range) ToS=0x00 proto=17 TTL=255 ID=0 offset=0 flags: -|-|- len=49664(correct) checksum=0x2e8d(correct) TCP: 83 bytes segment size (including TCP header) SP=0 (norange) (not random), DP=0 (norange) (not random) SQNR=3405691582 (start 0, stop 4294967295, delta 0) -- ACKNR=0 (invalid) Flags: ------------------------SYN----, reserved field is 00, urgent pointer= 0 Announced window size= 100 Offset= 0 (times 32 bit; value is valid), checksum= ffff (valid) (No TCP options attached) - 0 bytes defined Payload size: 43 bytes Frame size: 125 bytes 1 ff:ff:ff:ff:ff:ff:00:30 05:76:2e:8d:81:00:e0:01 81:00:a0:c8:08:00:45:00 00:67:00:00:00:00:ff:06 33 fa:e4:c0:a8:00:04:ff:ff ff:ff:00:00:00:00:ca:fe ba:be:00:00:00:00:a0:07 00:64:f7:ab:00:00:02:04 65 05:ac:04:02:08:0a:19:35 90:c3:00:00:00:00:01:03 03:05:54:68:69:73:20:69 73:20:61:20:64:75:6d:6d 97 79:20:70:61:79:6c:6f:61 64:20:66:6f:72:20:6d:79 20:66:69:72:73:74:20:70 61:63:6b:65:74 mz#

If you want to stop one or more packet processes, use the stop command. The "emergency stop" is when you use stop all:

mz# stop all Stopping [3] PKT0003 Stopped 1 transmission processe(s)

The launch command provides a shortcut for commonly used packet processes. For example to behave like a STP-capable bridge we want to start an BPDU process with typical parameters:

mz# launch bpdu Allocated new packet sysBPDU at slot 5 mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config eth0 1000 usec 1000/1000 (0%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/12 (0%) 4 PKT0004 E---I- IGMP 46 config eth0 100 msec 0/0 (0%) 5 sysBPDU ES---- BPDU 29 active eth0 2 sec 0/1 (0%) 5 packets defined, 1 active.

Now a Configuration BPDU is sent every 2 seconds, claiming to be the root bridge (and usually confusing the LAN. Note that only packet 5 (i.e. the last row) is active and therefore sending packets while all other packets are in state config (i.e. they have been configured but they are not doing anything at the moment).

Configuring a greater interval: Sometimes you may want to send a burst of packets at a greater interval:

mz(config)# packet 2 Modify packet parameters for packet Test [2] mz(config-pkt-2)# interval Configure a greater packet interval in days, hours, minutes, or seconds Arguments: <value> <days | hours | minutes | seconds> Use a zero value to disable an interval. mz(config-pkt-2)# interval 1 hour mz(config-pkt-2)# count 10 mz(config-pkt-2)# delay 15 usec Inter-packet delay set to 0 sec and 15000 nsec

Now this packet is sent ten times with an inter-packet delay of 15 microseconds and this is repeated every hour. When you look at the packet list, an interval is indicated with the additional flag 'i' when inactive or 'I' when active:

mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config-i eth0 15 usec 10/10 (0%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/12 (0%) 4 PKT0004 E---I- IGMP 46 config eth0 100 msec 0/0 (0%) 5 sysBPDU ES---- BPDU 29 active eth0 2 sec 0/251 (0%) 5 packets defined, 1 active. mz# start slot 2 Activate [2] mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config+I eth0 15 usec 10/0 (100%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/12 (0%) 4 PKT0004 E---I- IGMP 46 config eth0 100 msec 0/0 (0%) 5 sysBPDU ES---- BPDU 29 active eth0 2 sec 0/256 (0%) 5 packets defined, 1 active.

Note that the flag 'I' indicates that an interval has been specified for packet 2. The process is not active at the moment (only packet 5 is active here) but it will become active at a regular interval. You can verify the actual interval when viewing the packet details via the 'show packet 2' command.

Load prepared configurations: You can prepare packet configurations using the same commands as you would type them in on the CLI and then load them to the CLI. For example, assume we have prepared a file 'test.mops' containing:

configure terminal packet name IGMP_TEST desc This is only a demonstration how to load a file to mops type igmp

Then we can add this packet configuration to our packet list using the load command:

mz# load test.mops Read commands from test.mops... Allocated new packet PKT0002 at slot 2 mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 IGMP_TEST E---I- IGMP 46 config eth0 100 msec 0/0 (0%) 2 packets defined, 0 active.

The file src/examples/mausezahn/example_lldp.conf contains another example list of commands to create a bogus LLDP packet. You can load this configuration from the mausezahn command line as follows:

mz# load /home/hh/tmp/example_lldp.conf

In case you copied the file in that path. Now when you enter 'show packet' you will see a new packet entry in the packet list. Use the 'start slot <nr>' command to activate this packet.

You can store your own packet creations in such a file and easily load them when you need them. Every command within such configuration files is executed on the command line interface as if you had typed it in -- so be careful about the order and don't forget to use 'configure terminal' as first command.

You can even load other files from within a central config file.

Исходный текст на man7.org

mausezahn ( 8 )

INTERACTIVE MODE HOWTO

`mausezahn` ( 8 )