| blob | ead5dd011c0e9ef7389c7fc7f08347cd4e347840 |
1 .\" netsniff-ng - the packet sniffing beast
2 .\" Copyright 2013 Daniel Borkmann.
3 .\" Subject to the GPL, version 2.
4 .TH TRAFGEN 8 "03 March 2013" "Linux" "netsniff-ng toolkit"
5 .SH NAME
6 trafgen \- a fast, multithreaded network packet generator
7 .PP
8 .SH SYNOPSIS
9 .PP
10 \fBtrafgen\fP [\fIoptions\fP] [\fIpacket\fP]
11 .PP
12 .SH DESCRIPTION
13 .PP
14 trafgen is a fast, zero-copy network traffic generator for debugging,
15 performance evaluation, and fuzz-testing. trafgen utilizes the
16 .BR packet (7)
17 socket interface of Linux which postpones complete control over packet data
18 and packet headers into the user space. It has a powerful packet configuration
19 language, which is rather low-level and not limited to particular protocols.
20 Thus, trafgen can be used for many purposes. Its only limitation is that it
21 cannot mimic full streams resp. sessions. However, it is very useful for
22 various kinds of load testing in order to analyze and subsequently improve
23 systems behaviour under DoS attack scenarios, for instance.
24 .PP
25 trafgen is Linux specific, meaning there is no support for other operating
26 systems, same as
27 .BR netsniff-ng (8),
28 thus we can keep the code footprint quite minimal and to the point. trafgen
29 makes use of
30 .BR packet (7)
31 socket's TX_RING interface of the Linux kernel, which is a
32 .BR mmap (2)'ed
33 ring buffer shared between user and kernel space.
34 .PP
35 By default, trafgen starts as many processes as available CPUs, pins each
36 of them to their respective CPU and sets up the ring buffer each in their own
37 process space after having compiled a list of packets to transmit. Thus, this is
38 likely the fastest one can get out of the box in terms of transmission performance
39 from user space, without having to load unsupported or non-mainline third-party
40 kernel modules. On Gigabit Ethernet, trafgen has a comparable performance to
41 pktgen, the built-in Linux kernel traffic generator, except that trafgen is more
42 flexible in terms of packet configuration possibilities. On 10-Gigabit-per-second
43 Ethernet, trafgen might be slower than pktgen due to the user/kernel space
44 overhead but still has a fairly high performance for out of the box kernels.
45 .PP
46 trafgen has the potential to do fuzz testing, meaning a packet configuration can
47 be built with random numbers on all or certain packet offsets that are freshly
48 generated each time a packet is sent out. With a built-in IPv4 ping, trafgen can
49 send out an ICMP probe after each packet injection to the remote host in order
50 to test if it is still responsive/alive. Assuming there is no answer from the
51 remote host after a certain threshold of probes, the machine is considered dead
52 and the last sent packet is printed together with the random seed that was used
53 by trafgen. You might not really get lucky fuzz-testing the Linux kernel, but
54 presumably there are buggy closed-source embedded systems or network driver's
55 firmware files that are prone to bugs, where trafgen could help in finding them.
56 .PP
57 trafgen's configuration language is quite powerful, also due to the fact, that
58 it supports C preprocessor macros. A stddef.h is being shipped with trafgen for
59 this purpose, so that well known defines from Linux kernel or network programming
60 can be reused. After a configuration file has passed the C preprocessor stage,
61 it is processed by the trafgen packet compiler. The language itself supports a
62 couple of features that are useful when assembling packets, such as built-in
63 runtime checksum support for IP, UDP and TCP. Also it has an expression evaluator
64 where arithmetic (basic operations, bit operations, bit shifting, ...) on constant
65 expressions is being reduced to a single constant on compile time. Other features
66 are ''fill'' macros, where a packet can be filled with n bytes by a constant, a
67 compile-time random number or run-time random number (as mentioned with fuzz
68 testing). Also,
69 .BR netsniff-ng (8)
70 is able to convert a pcap file into a trafgen configuration file, thus such a
71 configuration can be further tweaked for a given scenario.
72 .PP
73 .SH OPTIONS
74 .TP
75 .B -i <cfg|pcap|->, -c <cfg|->, --in <cfg|pcap|->, --conf <cfg|->
76 Defines the input configuration file that can either be passed as a normal plain
77 text file or via stdin (''-''). Note that currently, if a configuration is
78 passed through stdin, only 1 CPU will be used.
79 It is also possible to specify PCAP file with .pcap extension via
80 \fB-i\fP/\fB--in\fP option, by default packets will be sent at rate considering
81 timestamp from PCAP file which might be reset via the \fB-b\fP or \fB-t\fP option.
82 .TP
83 .B -o <dev|.pcap|.cfg>, -d <dev|.pcap|.cfg>, --out <dev|.pcap|.cfg>, --dev <dev|.pcap|.cfg>
84 Defines the outgoing networking device such as eth0, wlan0 and others or
85 a *.pcap or *.cfg file. Pcap and configuration files are identified by extension.
86 .TP
87 .B -p, --cpp
88 Pass the packet configuration to the C preprocessor before reading it into
89 trafgen. This allows #define and #include directives (e.g. to include
90 definitions from system headers) to be used in the trafgen configuration file.
91 .TP
92 .B -D <name>=<definition>, --define <name>=<definition>
93 Add macro definition for the C preprocessor to use it within trafgen file. This
94 option is used in combination with the \fB-p\fP/\fB--cpp\fP option.
95 .TP
96 .B -J, --jumbo-support
97 By default trafgen's ring buffer frames are of a fixed size of 2048 bytes.
98 This means that if you're expecting jumbo frames or even super jumbo frames to
99 pass your line, then you will need to enable support for that with the help of
100 this option. However, this has the disadvantage of a performance regression and
101 a bigger memory footprint for the ring buffer.
102 .TP
103 .B -R, --rfraw
104 In case the output networking device is a wireless device, it is possible with
105 trafgen to turn this into monitor mode and create a mon<X> device that trafgen
106 will be transmitting on instead of wlan<X>, for instance. This enables trafgen
107 to inject raw 802.11 frames. In case if the output is a pcap file the link type
108 is set to 127 (ieee80211 radio tap).
109 .TP
110 .B -s <ipv4>, --smoke-test <ipv4>
111 In case this option is enabled, trafgen will perform a smoke test. In other
112 words, it will probe the remote end, specified by an <ipv4> address, that is
113 being ''attacked'' with trafgen network traffic, if it is still alive and
114 responsive. That means, after each transmitted packet that has been configured,
115 trafgen sends out ICMP echo requests and waits for an answer before it continues.
116 In case the remote end stays unresponsive, trafgen assumes that the machine
117 has crashed and will print out the content of the last packet as a trafgen
118 packet configuration and the random seed that has been used in order to
119 reproduce a possible bug. This might be useful when testing proprietary embedded
120 devices. It is recommended to have a direct link between the host running
121 trafgen and the host being attacked by trafgen.
122 .TP
123 .B -n <0|uint>, --num <0|uint>
124 Process a number of packets and then exit. If the number of packets is 0, then
125 this is equivalent to infinite packets resp. processing until interrupted.
126 Otherwise, a number given as an unsigned integer will limit processing.
127 .TP
128 .B -r, --rand
129 Randomize the packet selection of the configuration file. By default, if more
130 than one packet is defined in a packet configuration, packets are scheduled for
131 transmission in a round robin fashion. With this option, they are selected
132 randomly instread.
133 .TP
134 .B -P <uint>, --cpus <uint>
135 Specify the number of processes trafgen shall
136 .Br fork (2)
137 off. By default trafgen will start as many processes as CPUs that are online and
138 pin them to each, respectively. Allowed value must be within interval [1,CPUs].
139 .TP
140 .B -t <time>, --gap <time>
141 Specify a static inter-packet timegap in seconds, milliseconds, microseconds,
142 or nanoseconds: ''<num>s/ms/us/ns''. If no postfix is given default to
143 microseconds. If this option is given, then instead of
144 .BR packet (7)'s
145 TX_RING interface, trafgen will use
146 .BR sendto (2)
147 I/O for network packets, even if the <time> argument is 0. This option is useful
148 for a couple of reasons:
150 1) comparison between
151 .BR sendto (2)
152 and TX_RING performance,
153 2) low-traffic packet probing for a given interval,
154 3) ping-like debugging with specific payload patterns.
156 Furthermore, the TX_RING interface does not cope with interpacket gaps.
157 .TP
158 .B -b <rate>, --rate <rate>
159 Specify the packet send rate <num>pps/B/kB/MB/GB/kbit/Mbit/Gbit/KiB/MiB/GiB units.
160 Like with the \fB-t\fP/\fB--gap\fP option, the packets are sent in slow mode.
161 .TP
162 .B -S <size>, --ring-size <size>
163 Manually define the TX_RING resp. TX_RING size in ''<num>KiB/MiB/GiB''. By
164 default the size is being determined based on the network connectivity rate.
165 .TP
166 .B -E <uint>, --seed <uint>
167 Manually set the seed for pseudo random number generator (PRNG) in trafgen. By
168 default, a random seed from /dev/urandom is used to feed glibc's PRNG. If that
169 fails, it falls back to the unix timestamp. It can be useful to set the seed
170 manually in order to be able to reproduce a trafgen session, e.g. after fuzz
171 testing.
172 .TP
173 .B -u <uid>, --user <uid> resp. -g <gid>, --group <gid>
174 After ring setup, drop privileges to a non-root user/group combination.
175 .TP
176 .B -H, --prio-high
177 Set this process as a high priority process in order to achieve a higher
178 scheduling rate resp. CPU time. This is however not the default setting, since
179 it could lead to starvation of other processes, for example low priority kernel
180 threads.
181 .TP
182 .B -A, --no-sock-mem
183 Do not change systems default socket memory setting during testrun.
184 Default is to boost socket buffer memory during the test to:
186 /proc/sys/net/core/rmem_default:4194304
187 /proc/sys/net/core/wmem_default:4194304
188 /proc/sys/net/core/rmem_max:104857600
189 /proc/sys/net/core/wmem_max:104857600
190 .TP
191 .B -Q, --notouch-irq
192 Do not reassign the NIC's IRQ CPU affinity settings.
193 .TP
194 .B -q, --qdisc-path
195 Since Linux 3.14, the kernel supports a socket option PACKET_QDISC_BYPASS,
196 which trafgen enables by default. This options disables the qdisc bypass,
197 and uses the normal send path through the kernel's qdisc (traffic control)
198 layer, which can be usefully for testing the qdisc path.
199 .TP
200 .B -V, --verbose
201 Let trafgen be more talkative and let it print the parsed configuration and
202 some ring buffer statistics.
203 .TP
204 .B -e, --example
205 Show a built-in packet configuration example. This might be a good starting
206 point for an initial packet configuration scenario.
207 .TP
208 .B -C, --no-cpu-stats
209 Do not print CPU time statistics on exit.
210 .TP
211 .B -v, --version
212 Show version information and exit.
213 .TP
214 .B -h, --help
215 Show user help and exit.
216 .PP
217 .SH SYNTAX
218 .PP
219 trafgen's packet configuration syntax is fairly simple. The very basic things
220 one needs to know is that a configuration file is a simple plain text file
221 where packets are defined. It can contain one or more packets. Packets are
222 enclosed by opening '{' and closing '}' braces, for example:
223 .PP
224 { /* packet 1 content goes here ... */ }
225 { /* packet 2 content goes here ... */ }
226 .PP
227 Alternatively, packets can also be specified directly on the command line, using
228 the same syntax as used in the configuration files.
229 .PP
230 When trafgen is started using multiple CPUs (default), then each of those packets
231 will be scheduled for transmission on all CPUs by default. However, it is possible
232 to tell trafgen to schedule a packet only on a particular CPU:
233 .PP
234 cpu(1): { /* packet 1 content goes here ... */ }
235 cpu(2-3): { /* packet 2 content goes here ... */ }
236 .PP
237 Thus, in case we have a 4 core machine with CPU0-CPU3, packet 1 will be scheduled
238 only on CPU1, packet 2 on CPU2 and CPU3. When using trafgen with \-\-num option,
239 then these constraints will still be valid and the packet is fairly distributed
240 among those CPUs.
241 .PP
242 Packet content is delimited either by a comma or whitespace, or both:
243 .PP
244 { 0xca, 0xfe, 0xba 0xbe }
245 .PP
246 Packet content can be of the following:
247 .PP
248 hex bytes: 0xca, xff
249 decimal: 42
250 binary: 0b11110000, b11110000
251 octal: 011
252 character: 'a'
253 string: "hello world"
254 shellcode: "\\x31\\xdb\\x8d\\x43\\x17\\x99\\xcd\\x80\\x31\\xc9"
255 .PP
256 Thus, a quite useless packet configuration might look like this (one can verify
257 this when running this with trafgen in combination with \-V):
258 .PP
259 { 0xca, 42, 0b11110000, 011, 'a', "hello world",
260 "\\x31\\xdb\\x8d\\x43\\x17\\x99\\xcd\\x80\\x31\\xc9" }
261 .PP
262 There are a couple of helper functions in trafgen's language to make life easier
263 to write configurations:
264 .PP
265 .B i) Fill with garbage functions:
266 .PP
267 byte fill function: fill(<content>, <times>): fill(0xca, 128)
268 compile-time random: rnd(<times>): rnd(128), rnd()
269 runtime random numbers: drnd(<times>): drnd(128), drnd()
270 compile-time counter: seqinc(<start-val>, <increment>, <times>)
271 seqdec(<start-val>, <decrement>, <times>)
272 runtime counter (1byte): dinc(<min-val>, <max-val>, <increment>)
273 ddec(<min-val>, <max-val>, <decrement>)
274 .PP
275 .B ii) Checksum helper functions (packet offsets start with 0):
276 .PP
277 IP/ICMP checksum: csumip/csumicmp(<off-from>, <off-to>)
278 UDP checksum: csumudp(<off-iphdr>, <off-udpdr>)
279 TCP checksum: csumtcp(<off-iphdr>, <off-tcphdr>)
280 UDP checksum (IPv6): csumudp6(<off-ip6hdr>, <off-udpdr>)
281 TCP checksum (IPv6): csumtcp6(<off-ip6hdr>, <off-tcphdr>)
282 .PP
283 .B iii) Multibyte functions, compile-time expression evaluation:
284 .PP
285 const8(<content>), c8(<content>), const16(<content>), c16(<content>),
286 const32(<content>), c32(<content>), const64(<content>), c64(<content>)
287 .PP
288 These functions write their result in network byte order into the packet
289 configuration, e.g. const16(0xaa) will result in ''00 aa''. Within c*()
290 functions, it is possible to do some arithmetics: -,+,*,/,%,&,|,<<,>>,^
291 E.g. const16((((1<<8)+0x32)|0b110)*2) will be evaluated to ''02 6c''.
292 .PP
293 .B iv) Protocol header functions:
294 .in +4
295 The protocol header functions allow to fill protocol header fields by
296 using following generic syntax:
297 .sp
298 .in +4
299 <proto>(<field>=<value>,<field2>=<value2>,...,<field3>,...)
300 .in -4
301 .sp
302 .in -4
303 .in +4
304 If a field is not specified, then a default value will be used (usually 0).
305 Protocol fields might be set in any order. However, the offset of the fields in
306 the resulting packet is according to the respective protocol.
307 .sp
308 Each field might be set with a function which generates field value at runtime by
309 increment or randomize it. For L3/L4 protocols the checksum is calculated automatically
310 if the field was changed dynamically by specified function. The following field
311 functions are supported:
312 .in +4
313 .sp
314 .B dinc
315 - increment field value at runtime. By default increment step is '1'.
316 .B min
317 and
318 .B max
319 parameters are used to increment field only in the specified range, by default original
320 field value is used. If the field length is greater than 4 then last 4 bytes are
321 incremented only (useful for MAC and IPv6 addresses):
322 .in +4
323 .sp
324 <field> = dinc() | dinc(min, max) | dinc(min, max, step)
325 .in -4
326 .sp
327 .B drnd
328 - randomize field value at runtime.
329 .B min
330 and
331 .B max
332 parameters are used to randomize field only in the specified range:
333 .in +4
334 .sp
335 <field> = drnd() | drnd(min, max)
336 .in -4
337 .sp
338 Example of using dynamic functions:
339 .sp
340 {
341 .in +2
342 eth(saddr=aa:bb:cc:dd:ee:ff, saddr=dinc()),
343 ipv4(saddr=dinc()),
344 udp(sport=dinc(1, 13, 2), dport=drnd(80, 100))
345 .in -2
346 }
348 .in -4
350 .sp
351 Fields might be further manipulated with a function at a specific offset:
352 .sp
353 .in +4
354 <field>[<index>] | <field>[<index>:<length>]
355 .sp
356 .in +4
357 <index> - relative field offset with range 0..<field.len> - 1
358 .sp
359 <length> - length/size of the value which will be set; either 1, 2 or 4 bytes (default: 1)
360 .in -4
361 .sp
362 The <index> starts from the field's first byte in network order.
363 .sp
364 The syntax is similar to the one used in pcap filters (man pcap-filter) for
365 matching header field at a specified offset.
366 .sp
367 Examples of using field offset (showing the effect in a shortenet output from
368 netsniff-ng):
369 .sp
370 .in +4
371 1) trafgen -o lo --cpus 1 -n 3 '{ eth(da=11:22:33:44:55:66, da[0]=dinc()), tcp() }'
373 .in +4
374 [ Eth MAC (00:00:00:00:00:00 => 11:22:33:44:55:66)
376 [ Eth MAC (00:00:00:00:00:00 => 12:22:33:44:55:66)
378 [ Eth MAC (00:00:00:00:00:00 => 13:22:33:44:55:66)
379 .in -4
381 2) trafgen -o lo --cpus 1 -n 3 '{ ipv4(da=1.2.3.4, da[0]=dinc()), tcp() }'
383 .in +4
384 [ IPv4 Addr (127.0.0.1 => 1.2.3.4)
386 [ IPv4 Addr (127.0.0.1 => 2.2.3.4)
388 [ IPv4 Addr (127.0.0.1 => 3.2.3.4)
389 .in -4
391 .in -4
392 .in -4
394 .sp
395 All required lower layer headers will be filled automatically if they were not
396 specified by the user. The headers will be filled in the order they were
397 specified. Each header will be filled with some mimimum required set of fields.
398 .in -4
399 .sp
400 .in +4
401 Supported protocol headers:
402 .sp
403 .I Ethernet
404 :
405 .B eth(da=<mac>, sa=<mac>, type=<number>)
406 .sp
407 .in +4
408 .B da|daddr
409 - Destination MAC address (default: 00:00:00:00:00:00)
410 .sp
411 .B sa|saddr
412 - Source MAC address (default: device MAC address)
413 .sp
414 .B etype|type|prot|proto
415 - Ethernet type (default: 0)
416 .in -4
418 .sp
419 .I PAUSE (IEEE 802.3X)
420 :
421 .B pause(code=<number>, time=<number>)
422 .sp
423 .in +4
424 .B code
425 - MAC Control opcode (default: 0x0001)
426 .sp
427 .B time
428 - Pause time (default: 0)
429 .sp
430 By default Ethernet header is added with a fields:
431 .in +4
432 .sp
433 Ethernet type - 0x8808
434 .sp
435 Destination MAC address - 01:80:C2:00:00:01
436 .in -4
438 .in -4
440 .sp
441 .I PFC
442 :
443 .B pfc(pri|prio(<number>)=<number>, time(<number>)=<number>)
444 .sp
445 .in +4
446 .B code
447 - MAC Control opcode (default: 0x0101)
448 .sp
449 .B pri|prio
450 - Priority enable vector (default: 0)
451 .sp
452 .B pri|prio(<number>)
453 - Enable/disable (0 - disable, 1 - enable) pause for priority <number> (default: 0)
454 .sp
455 .B time(<number>)
456 - Set pause time for priority <number> (default: 0)
457 .sp
458 By default Ethernet header is added with a fields:
459 .in +4
460 .sp
461 Ethernet type - 0x8808
462 .sp
463 Destination MAC address - 01:80:C2:00:00:01
464 .in -4
466 .in -4
467 .I VLAN
468 :
469 .B vlan(tpid=<number>, id=<number>, dei=<number>, tci=<number>, pcp=<number>, 1q, 1ad)
470 .sp
471 .in +4
472 .B tpid|prot|proto
473 - Tag Protocol Identifier (TPID) (default: 0x8100)
474 .sp
475 .B tci
476 - Tag Control Information (TCI) field (VLAN Id + PCP + DEI) (default: 0)
477 .sp
478 .B dei|cfi
479 - Drop Eligible Indicator (DEI), formerly Canonical Format Indicator (CFI) (default: 0)
480 .sp
481 .B pcp
482 - Priority code point (PCP) (default: 0)
483 .sp
484 .B id
485 - VLAN Identifier (default: 0)
486 .sp
487 .B 1q
488 - Set 802.1q header (TPID: 0x8100)
489 .sp
490 .B 1ad
491 - Set 802.1ad header (TPID: 0x88a8)
492 .sp
493 .in -4
494 By default, if the lower level header is Ethernet, its EtherType is set to
495 0x8100 (802.1q).
496 .sp
498 .I MPLS
499 :
500 .B mpls(label=<number>, tc|exp=<number>, last=<number>, ttl=<number>)
501 .sp
502 .in +4
503 .B label|lbl
504 - MPLS label value (default: 0)
505 .sp
506 .B tclass|tc|exp
507 - Traffic Class for QoS field (default: 0)
508 .sp
509 .B last
510 - Bottom of stack S-flag (default: 1 for most last label)
511 .sp
512 .B ttl
513 - Time To Live (TTL) (default: 0)
514 .sp
515 .in -4
516 By default, if the lower level header is Ethernet, its EtherType is set to
517 0x8847 (MPLS Unicast). S-flag is set automatically to 1 for the last label and
518 resets to 0 if the lower MPLS label was added after.
519 .sp
521 .I ARP
522 :
523 .B arp(htype=<number>, ptype=<number>, op=<request|reply|number>, request,
524 .B reply, smac=<mac>, sip=<ip4_addr>, tmac=<mac>, tip=<ip4_addr>)
525 .sp
526 .in +4
527 .B htype
528 - ARP hardware type (default: 1 [Ethernet])
529 .sp
530 .B ptype
531 - ARP protocol type (default: 0x0800 [IPv4])
532 .sp
533 .B op
534 - ARP operation type (request/reply) (default: request)
535 .sp
536 .B req|request
537 - ARP Request operation type
538 .sp
539 .B reply
540 - ARP Reply operation type
541 .sp
542 .B smac|sha
543 - Sender hardware (MAC) address (default: device MAC address)
544 .sp
545 .B sip|spa
546 - Sender protocol (IPv4) address (default: device IPv4 address)
547 .sp
548 .B tmac|tha
549 - Target hardware (MAC) address (default: 00:00:00:00:00:00)
550 .sp
551 .B tip|tpa
552 - Target protocol (IPv4) address (default: device IPv4 address)
553 .in -4
554 .sp
555 By default, the ARP operation field is set to request and the Ethernet
556 destination MAC address is set to the broadcast address (ff:ff:ff:ff:ff:ff).
558 .I IPv4
559 :
560 .B ip4|ipv4(ihl=<number>, ver=<number>, len=<number>, csum=<number>,
561 .B ttl=<number>, tos=<number>, dscp=<number>, ecn=<number>,
562 .in +16
563 .B id=<number>, flags=<number>, frag=<number>, df, mf, da=<ip4_addr>, sa=<ip4_addr>,
564 .B prot[o]=<number>)
565 .in -16
566 .sp
567 .in +4
568 .B ver|version
569 - Version field (default: 4)
570 .sp
571 .B ihl
572 - Header length in number of 32-bit words (default: 5)
573 .sp
574 .B tos
575 - Type of Service (ToS) field (default: 0)
576 .sp
577 .B dscp
578 - Differentiated Services Code Point (DSCP, DiffServ) field (default: 0)
579 .sp
580 .B ecn
581 - Explicit Congestion Notification (ECN) field (default: 0)
582 .sp
583 .B len|length
584 - Total length of header and payload (calculated by default)
585 .sp
586 .B id
587 - IPv4 datagram identification (default: 0)
588 .sp
589 .B flags
590 - IPv4 flags value (DF, MF) (default: 0)
591 .sp
592 .B df
593 - Don't fragment (DF) flag (default: 0)
594 .sp
595 .B mf
596 - More fragments (MF) flag (default: 0)
597 .sp
598 .B frag
599 - Fragment offset field in number of 8 byte blocks (default: 0)
600 .sp
601 .B ttl
602 - Time to live (TTL) field (default: 0)
603 .sp
604 .B csum
605 - Header checksum (calculated by default)
606 .sp
607 .B sa|saddr
608 - Source IPv4 address (default: device IPv4 address)
609 .sp
610 .B da|daddr
611 - Destination IPv4 address (default: 0.0.0.0)
612 .sp
613 .B prot|proto
614 - IPv4 protocol number (default: 0)
615 .in -4
616 .sp
617 By default, if the lower level header is Ethernet, its EtherType field is set to
618 0x0800 (IPv4). If the lower level header is IPv4, its protocol field is set to
619 0x4 (IP-in-IP).
621 .I IPv6
622 :
623 .B ip6|ipv6(ver=<number>, class=<number>, flow=<number> len=<number>,
624 .B nexthdr=<number>, hoplimit=<number>,
625 .in +16
626 .B da=<ip6_addr>, sa=<ip6_addr>)
627 .in -16
628 .sp
629 .in +4
630 .B ver|version
631 - Version field (default: 6)
632 .sp
633 .B tc|tclass
634 - Traffic class (default: 0)
635 .sp
636 .B fl|flow
637 - Flow label (default: 0)
638 .sp
639 .B len|length
640 - Payload length (calculated by default)
641 .sp
642 .B nh|nexthdr
643 - Type of next header, i.e. transport layer protocol number (default: 0)
644 .sp
645 .B hl|hoplimit|ttl
646 - Hop limit, i.e. time to live (default: 0)
647 .sp
648 .B sa|saddr
649 - Source IPv6 address (default: device IPv6 address)
650 .sp
651 .B da|daddr
652 - Destination IPv6 address (default: 0:0:0:0:0:0:0:0)
653 .in -4
654 .sp
655 By default, if the lower level header is Ethernet, its EtherType field is set to
656 0x86DD (IPv6).
658 .I ICMPv4
659 :
660 .B icmp4|icmpv4(type=<number>, code=<number>, echorequest, echoreply,
661 .B csum=<number>, mtu=<number>, seq=<number>, id=<number>, addr=<ip4_addr>)
662 .sp
663 .in +4
664 .B type
665 - Message type (default: 0 - Echo reply)
666 .sp
667 .B code
668 - Message code (default: 0)
669 .sp
670 .B echorequest
671 - ICMPv4 echo (ping) request (type: 8, code: 0)
672 .sp
673 .B echoreply
674 - ICMPv4 echo (ping) reply (type: 0, code: 0)
675 .sp
676 .B csum
677 - Checksum of ICMPv4 header and payload (calculated by default)
678 .sp
679 .B mtu
680 - Next-hop MTU field used in 'Datagram is too big' message type (default; 0)
681 .sp
682 .B seq
683 - Sequence number used in Echo/Timestamp/Address mask messages (default: 0)
684 .sp
685 .B id
686 - Identifier used in Echo/Timestamp/Address mask messages (default: 0)
687 .sp
688 .B addr
689 - IPv4 address used in Redirect messages (default: 0.0.0.0)
690 .sp
691 .in -4
692 Example ICMP echo request (ping):
693 .in +4
694 .sp
695 { icmpv4(echorequest, seq=1, id=1326) }
696 .in -4
698 .I ICMPv6
699 :
700 .B icmp6|icmpv6(type=<number>, echorequest, echoreply, code=<number>,
701 .B csum=<number>)
702 .sp
703 .in +4
704 .B type
705 - Message type (default: 0)
706 .sp
707 .B code
708 - Code (default: 0)
709 .sp
710 .B echorequest
711 - ICMPv6 echo (ping) request
712 .sp
713 .B echoreply
714 - ICMPv6 echo (ping) reply
715 .sp
716 .B csum
717 - Message checksum (calculated by default)
718 .in -4
719 .sp
720 By default, if the lower level header is IPv6, its Next Header field is set to
721 58 (ICMPv6).
723 .I UDP
724 :
725 .B udp(sp=<number>, dp=<number>, len=<number>, csum=<number>)
726 .sp
727 .in +4
728 .B sp|sport
729 - Source port (default: 0)
730 .sp
731 .B dp|dport
732 - Destination port (default: 0)
733 .sp
734 .B len|length
735 - Length of UDP header and data (calculated by default)
736 .sp
737 .B csum
738 - Checksum field over IPv4 pseudo header (calculated by default)
739 .sp
740 .in -4
741 By default, if the lower level header is IPv4, its protocol field is set to
742 0x11 (UDP).
744 .I TCP
745 :
746 .B tcp(sp=<number>, dp=<number>, seq=<number>, aseq|ackseq=<number>, doff|hlen=<number>,
747 .B cwr, ece|ecn, urg, ack, psh, rst, syn, fin, win|window=<number>, csum=<number>,
748 .B urgptr=<number>)
749 .sp
750 .in +4
751 .B sp|sport
752 - Source port (default: 0)
753 .sp
754 .B dp|dport
755 - Destination port (default: 0)
756 .sp
757 .B seq
758 - Sequence number (default: 0)
759 .sp
760 .B aseq|ackseq
761 - Acknowledgement number (default: 0)
762 .sp
763 .B doff|hlen
764 - Header size (data offset) in number of 32-bit words (default: 5)
765 .sp
766 .B cwr
767 - Congestion Window Reduced (CWR) flag (default: 0)
768 .sp
769 .B ece|ecn
770 - ECN-Echo (ECE) flag (default: 0)
771 .sp
772 .B urg
773 - Urgent flag (default: 0)
774 .sp
775 .B ack
776 - Acknowledgement flag (default: 0)
777 .sp
778 .B psh
779 - Push flag (default: 0)
780 .sp
781 .B rst
782 - Reset flag (default: 0)
783 .sp
784 .B syn
785 - Synchronize flag (default: 0)
786 .sp
787 .B fin
788 - Finish flag (default: 0)
789 .sp
790 .B win|window
791 - Receive window size (default: 0)
792 .sp
793 .B csum
794 - Checksum field over IPv4 pseudo header (calculated by default)
795 .sp
796 .B urgptr
797 - Urgent pointer (default: 0)
798 .sp
799 .in -4
800 By default, if the lower level header is IPv4, its protocol field is set to
801 0x6 (TCP).
803 Simple example of a UDP Echo packet:
804 .PP
805 .in +5
806 {
807 eth(da=11:22:33:44:55:66),
808 ipv4(daddr=1.2.3.4)
809 udp(dp=7),
810 "Hello world"
811 }
812 .in -5
813 .PP
814 Furthermore, there are two types of comments in trafgen configuration files:
815 .PP
816 1. Multi-line C-style comments: /* put comment here */
817 2. Single-line Shell-style comments: # put comment here
818 .PP
819 Next to all of this, a configuration can be passed through the C preprocessor
820 before the trafgen compiler gets to see it with option \fB--cpp\fP. To give you a
821 taste of a more advanced example, run ''trafgen \-e'', fields are commented:
822 .PP
823 /* Note: dynamic elements make trafgen slower! */
824 #include <stddef.h>
826 {
827 /* MAC Destination */
828 fill(0xff, ETH_ALEN),
829 /* MAC Source */
830 0x00, 0x02, 0xb3, drnd(3),
831 /* IPv4 Protocol */
832 c16(ETH_P_IP),
833 /* IPv4 Version, IHL, TOS */
834 0b01000101, 0,
835 /* IPv4 Total Len */
836 c16(59),
837 /* IPv4 Ident */
838 drnd(2),
839 /* IPv4 Flags, Frag Off */
840 0b01000000, 0,
841 /* IPv4 TTL */
842 64,
843 /* Proto TCP */
844 0x06,
845 /* IPv4 Checksum (IP header from, to) */
846 csumip(14, 33),
847 /* Source IP */
848 drnd(4),
849 /* Dest IP */
850 drnd(4),
851 /* TCP Source Port */
852 drnd(2),
853 /* TCP Dest Port */
854 c16(80),
855 /* TCP Sequence Number */
856 drnd(4),
857 /* TCP Ackn. Number */
858 c32(0),
859 /* TCP Header length + TCP SYN/ECN Flag */
860 c16((8 << 12) | TCP_FLAG_SYN | TCP_FLAG_ECE)
861 /* Window Size */
862 c16(16),
863 /* TCP Checksum (offset IP, offset TCP) */
864 csumtcp(14, 34),
865 /* TCP Options */
866 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x06,
867 0x91, 0x68, 0x7d, 0x06, 0x91, 0x68, 0x6f,
868 /* Data blob */
869 "gotcha!",
870 }
871 .PP
872 Another real-world example by Jesper Dangaard Brouer [1]:
873 .PP
874 {
875 # --- ethernet header ---
876 0x00, 0x1b, 0x21, 0x3c, 0x9d, 0xf8, # mac destination
877 0x90, 0xe2, 0xba, 0x0a, 0x56, 0xb4, # mac source
878 const16(0x0800), # protocol
879 # --- ip header ---
880 # ipv4 version (4-bit) + ihl (4-bit), tos
881 0b01000101, 0,
882 # ipv4 total len
883 const16(40),
884 # id (note: runtime dynamic random)
885 drnd(2),
886 # ipv4 3-bit flags + 13-bit fragment offset
887 # 001 = more fragments
888 0b00100000, 0,
889 64, # ttl
890 17, # proto udp
891 # dynamic ip checksum (note: offsets are zero indexed)
892 csumip(14, 33),
893 192, 168, 51, 1, # source ip
894 192, 168, 51, 2, # dest ip
895 # --- udp header ---
896 # as this is a fragment the below stuff does not matter too much
897 const16(48054), # src port
898 const16(43514), # dst port
899 const16(20), # udp length
900 # udp checksum can be dyn calc via csumudp(offset ip, offset tcp)
901 # which is csumudp(14, 34), but for udp its allowed to be zero
902 const16(0),
903 # payload
904 'A', fill(0x41, 11),
905 }
906 .PP
907 [1] https://marc.info/?l=linux-netdev&m=135903630614184
908 .PP
909 The above example rewritten using the header generation functions:
910 .PP
911 {
912 # --- ethernet header ---
913 eth(da=00:1b:21:3c:9d:f8, da=90:e2:ba:0a:56:b4)
914 # --- ip header ---
915 ipv4(id=drnd(), mf, ttl=64, sa=192.168.51.1, da=192.168.51.2)
916 # --- udp header ---
917 udp(sport=48054, dport=43514, csum=0)
918 # payload
919 'A', fill(0x41, 11),
920 }
921 .PP
922 .SH USAGE EXAMPLE
923 .TP
924 .B trafgen --dev eth0 --conf trafgen.cfg
925 This is the most simple and, probably, the most common use of trafgen. It
926 will generate traffic defined in the configuration file ''trafgen.cfg'' and
927 transmit this via the ''eth0'' networking device. All online CPUs are used.
928 .TP
929 .B trafgen -e | trafgen -i - -o lo --cpp -n 1
930 This is an example where we send one packet of the built-in example through
931 the loopback device. The example configuration is passed via stdin and also
932 through the C preprocessor before trafgen's packet compiler will see it.
933 .TP
934 .B trafgen --dev eth0 --conf fuzzing.cfg --smoke-test 10.0.0.1
935 Read the ''fuzzing.cfg'' packet configuration file (which contains drnd()
936 calls) and send out the generated packets to the ''eth0'' device. After each
937 sent packet, ping probe the attacked host with address 10.0.0.1 to check if
938 it's still alive. This also means, that we utilize 1 CPU only, and do not
939 use the TX_RING, but sendto(2) packet I/O due to ''slow mode''.
940 .TP
941 .B trafgen --dev wlan0 --rfraw --conf beacon-test.txf -V --cpus 2
942 As an output device ''wlan0'' is used and put into monitoring mode, thus we
943 are going to transmit raw 802.11 frames through the air. Use the
944 ''beacon-test.txf'' configuration file, set trafgen into verbose mode and
945 use only 2 CPUs.
946 .TP
947 .B trafgen --dev em1 --conf frag_dos.cfg --rand --gap 1000us
948 Use trafgen in sendto(2) mode instead of TX_RING mode and sleep after each
949 sent packet a static timegap for 1000us. Generate packets from ''frag_dos.cfg''
950 and select next packets to send randomly instead of a round-robin fashion.
951 The output device for packets is ''em1''.
952 .TP
953 .B trafgen --dev eth0 --conf icmp.cfg --rand --num 1400000 -k1000
954 Send only 1400000 packets using the ''icmp.cfg'' configuration file and then
955 exit trafgen. Select packets randomly from that file for transmission and
956 send them out via ''eth0''. Also, trigger the kernel every 1000us for batching
957 the ring frames from user space (default is 10us).
958 .TP
959 .B trafgen --dev eth0 --conf tcp_syn.cfg -u `id -u bob` -g `id -g bob`
960 Send out packets generated from the configuration file ''tcp_syn.cfg'' via
961 the ''eth0'' networking device. After setting up the ring for transmission,
962 drop credentials to the non-root user/group bob/bob.
963 .TP
964 .B trafgen --dev eth0 '{ fill(0xff, 6), 0x00, 0x02, 0xb3, rnd(3), c16(0x0800), fill(0xca, 64) }' -n 1
965 Send out 1 invaid IPv4 packet built from command line to all hosts.
966 .PP
967 .SH NOTE
968 .PP
969 trafgen can saturate a Gigabit Ethernet link without problems. As always,
970 of course, this depends on your hardware as well. Not everywhere where it
971 says Gigabit Ethernet on the box, will you reach almost physical line rate!
972 Please also read the
973 .BR netsniff-ng (8)
974 man page, section NOTE for further details about tuning your system e.g. with
975 .BR tuned (8).
976 .PP
977 If you intend to use trafgen on a 10-Gbit/s Ethernet NIC, make sure you
978 are using a multiqueue
979 .BR tc(8)
980 discipline, and make sure that the packets you generate with trafgen will have a
981 good distribution among tx_hashes so that you'll actually make use of
982 multiqueues.
983 .PP
984 For introducing bit errors, delays with random variation and more, there
985 is no built-in option in trafgen. Rather, one should reuse existing methods
986 for that which integrate nicely with trafgen, such as
987 .BR tc (8)
988 with its different disciplines, i.e. \fBnetem\fP.
989 .PP
990 For more complex packet configurations, it is recommended to use high-level
991 scripting for generating trafgen packet configurations in a more automated
992 way, i.e. also to create different traffic distributions that are common for
993 industrial benchmarking:
994 .PP
995 Traffic model Distribution
996 .PP
997 IMIX 64:7, 570:4, 1518:1
998 Tolly 64:55, 78:5, 576:17, 1518:23
999 Cisco 64:7, 594:4, 1518:1
1000 RPR Trimodal 64:60, 512:20, 1518:20
1001 RPR Quadrimodal 64:50, 512:15, 1518:15, 9218:20
1002 .PP
1003 The low-level nature of trafgen makes trafgen rather protocol independent
1004 and therefore useful in many scenarios when stress testing is needed, for
1005 instance. However, if a traffic generator with higher level packet
1006 descriptions is desired, netsniff-ng's mausezahn(8) can be of good use as
1007 well.
1008 .PP
1009 For smoke/fuzz testing with trafgen, it is recommended to have a direct
1010 link between the host you want to analyze (''victim'' machine) and the host
1011 you run trafgen on (''attacker'' machine). If the ICMP reply from the victim
1012 fails, we assume that probably its kernel crashed, thus we print the last
1013 sent packet together with the seed and quit probing. It might be very unlikely
1014 to find such a ping-of-death on modern Linux systems. However, there might
1015 be a good chance to find it on some proprietary (e.g. embedded) systems or
1016 buggy driver firmwares that are in the wild. Also, fuzz testing can be done
1017 on raw 802.11 frames, of course. In case you find a ping-of-death, please
1018 mention that you were using trafgen in your commit message of the fix!
1019 .PP
1020 .SH BUGS
1021 For old trafgen versions only, there could occur kernel crashes: we have fixed
1022 this bug in the mainline and stable kernels under commit 7f5c3e3a8 (''af_packet:
1023 remove BUG statement in tpacket_destruct_skb'') and also in trafgen.
1024 .PP
1025 Probably the best is if you upgrade trafgen to the latest version.
1026 .PP
1027 .SH LEGAL
1028 trafgen is licensed under the GNU GPL version 2.0.
1029 .PP
1030 .SH HISTORY
1031 .B trafgen
1032 was originally written for the netsniff-ng toolkit by Daniel Borkmann. It
1033 is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel
1034 Borkmann <dborkma@tik.ee.ethz.ch>.
1035 .PP
1036 .SH SEE ALSO
1037 .BR netsniff-ng (8),
1038 .BR mausezahn (8),
1039 .BR ifpps (8),
1040 .BR bpfc (8),
1041 .BR flowtop (8),
1042 .BR astraceroute (8),
1043 .BR curvetun (8)
1044 .PP
1045 .SH AUTHOR
1046 Manpage was written by Daniel Borkmann.
1047 .PP
1048 .SH COLOPHON
1049 This page is part of the Linux netsniff-ng toolkit project. A description of the project,
1050 and information about reporting bugs, can be found at http://netsniff-ng.org/.