Emca's Story

리눅스에서의 패킷 릴레이를 위한 tcpdump 및 tcpreplay활용

1.     사용 환경

1)    전송 장비 : Cisco Switch 6506

2)    릴레이 서버 : CentOS 5.5 32bit (이하 A)

3)    리시브 서버 : CentOS 4.7 32bit (이하 B)

2.     사용 툴

1)    Iptables: 방화벽의 용도가 아닌 패킷 릴레이를 위한 용도로 사용

2)    Tcpdump: 릴레이 서버가 받는 패킷을 캡쳐하기 위한 툴

3)    Tcpreplay: 받아들인 패킷을 재 전송하기 위한 툴

4)    Tcprewrite: tcpreplay에 포함되어 있는 툴로써 패킷의 dst,dmac 등을 수정하기 위한 툴

3.     릴레이 시나리오

1)    CiscoSwitch에서 A로의 snmpTrap 전송

2)    A에서 해당하는 패킷을 tcpdump로 캡쳐

3)    tcprewrite를 이용해 패킷 수정

4)    tcpreplay를 이용해 재전송

5)    B에서 확인

4.     테스트

1)    A에서 tcpdump로 받은 패킷 (수정전 원본 패킷)

2)    Tcprewrite로 수정 후

3)    Tcpreplay로 전송 후 B에서 캡쳐한 패킷

A에서 받은 패킷과 수정 후 패킷이 동일함은 Time으로 확인할 수 있으며

스크린샷 상에서는 확인이 불가하지만 Source의 mac주소도 동일함을 확인할 수 있다.

5.     Tcpdump사용법

tcpdump -nn -i eth0 dst port 162 -wsample.pcap -s 1000

> eth0으로들어오는 패킷 중 dst port가 162인 패킷을 1000byte까지의 사이즈로 sample.pcap으로 수집하라

상세한 내용은 man page를 참조하세요.

6.     Tcprewrite사용법

tcprewrite -i ./sample.pcap -o./sample_rewrite.pcap --dstipmap [수정될IP]:[수정할IP] --portmap [수정될port]:[수정할port] --enet-dmac=[목적지 mac주소] -C -v

> sample.pcap파일의 내용을 dstip,dmac,port를 변경 후  sample_rewrite.pcap으로 저장

옵션

tcprewrite(tcprewrite) - Rewrite the packets in a pcap file.

USAGE:  tcprewrite [ -<flag> [<val>] |--<name>[{=| }<val>] ]...

   -r, --portmap=str          Rewrite TCP/UDP ports

   -s, --seed=num             Randomize src/dst IPv4/v6addresses w/ given seed

   -N, --pnat=str             Rewrite IPv4/v6 addresses usingpseudo-NAT

   -S, --srcipmap=str         Rewrite source IPv4/v6 addresses usingpseudo-NAT

   -D, --dstipmap=str         Rewrite destination IPv4/v6 addressesusing pseudo                                -NAT

   -e, --endpoints=str        Rewrite IP addresses to be between twoendpoints

   -b, --skipbroadcast        Skip rewriting broadcast/multicastIPv4/v6 address                                es

   -C, --fixcsum              Force recalculation ofIPv4/TCP/UDP header checksu                                 ms

   -m, --mtu=num              Override default MTU length (1500bytes)

       --mtu-trunc            Truncate packets larger thenspecified MTU

   -E, --efcs                 Remove Ethernet checksums(FCS) from end of frames

       --ttl=str              Modify the IPv4/v6 TTL/Hop Limit

       --tos=num              Set the IPv4 TOS/DiffServ/ECN byte

       --tclass=num           Set the IPv6 Traffic Class byte

       --flowlabel=num        Set the IPv6 Flow Label

   -F, --fixlen=str           Pad or truncate packet data to matchheader length

       --skipl2broadcast      Skip rewriting broadcast/multicast Layer2 address                                es

       --dlt=str              Override output DLT encapsulation

       --enet-dmac=str        Override destination ethernet MACaddresses

       --enet-smac=str        Override source ethernet MAC addresses

       --enet-vlan=str        Specify ethernet 802.1q VLAN tag mode

       --enet-vlan-tag=num    Specify the new ethernet 802.1q VLAN tagvalue

       --enet-vlan-cfi=num    Specify the ethernet 802.1q VLAN CFI value

       --enet-vlan-pri=num    Specify the ethernet 802.1q VLAN priority

       --hdlc-control=num     Specify HDLC control value

       --hdlc-address=num     Specify HDLC address

       --user-dlt=num         Set output file DLT type

       --user-dlink=str       Rewrite Data-Link layer with userspecified data

   -i, --infile=str           Input pcap file to be processed

   -o, --outfile=str          Output pcap file

   -c, --cachefile=str        Split traffic via tcpprep cache file

   -v,--verbose              Print decodedpackets via tcpdump to STDOUT

   -A, --decode=str           Arguments passed to tcpdump decoder

       --fragroute=str        Parse fragroute configuration file

       --fragdir=str          Which flows to apply fragroute to:c2s, s2c, both

       --skip-soft-errors     Skip writing packets with soft errors

   -V, --version              Print version information

   -h, --less-help            Display less usage information andexit

   -H, --help                 Display usage information andexit

   -!, --more-help            Extended usage information passedthru pager

   -*, --save-opts[=arg]      Save the option state to a config file

   -+,--load-opts=str        Load options froma config file

7.     Tcpreplay

tcpreplay --topspeed --intf1=eth0./sample_rewrite.pcap

sample_rewrite.pcap 파일을 최고의 속력으로 eth0을 통해 전송

tcpreplay(tcpreplay) - Replay network traffic stored in pcap files

USAGE:  tcpreplay [ -<flag> [<val>] | --<name>[{=|}<val>] ]... <pcap_file(s)>

   -q, --quiet                Quiet mode

   -T, --timer=str            Select packet timing mode: select,ioport, rdtsc, gtod, nano, abstime

       --sleep-accel=num      Reduce the amount of time to sleep byspecified usec

       --rdtsc-clicks=num     Specify the RDTSC clicks/usec

   -v, --verbose              Print decoded packets via tcpdumpto STDOUT

   -A, --decode=str           Arguments passed to tcpdump decoder

   -K, --enable-file-cache    Enable caching of packets to internalmemory

   -c, --cachefile=str        Split traffic via a tcpprep cache file

   -i, --intf1=str            Server/primary traffic outputinterface

   -I, --intf2=str            Client/secondary traffic outputinterface

       --listnics             List available network interfacesand exit

   -l, --loop=num             Loop through the capture file Xtimes

       --pktlen               Override the snaplen and use theactual packet len

   -L, --limit=num            Limit the number of packets to send

   -x, --multiplier=str       Modify replay speed to a given multiple

   -p, --pps=num              Replay packets at a givenpackets/sec

   -M, --mbps=str             Replay packets at a given Mbps

   -t, --topspeed             Replay packets as fast as possible

   -o, --oneatatime           Replay one packet at a time for eachuser input

       --pps-multi=num        Number of packets to send for each timeinterval

   -P, --pid                  Print the PID of tcpreplay atstartup

   -V, --version              Print version information

   -h, --less-help            Display less usage information andexit

   -H, --help                 Display usage information andexit

   -!, --more-help            Extended usage information passedthru pager

       --save-opts[=arg]      Save the option state to a config file