1 .\" netsniff-ng - the packet sniffing beast
2 .\" Copyright 2013 Daniel Borkmann.
3 .\" Subject to the GPL, version 2.
4 .TH TRAFGEN 8 "03 March 2013" "Linux" "netsniff-ng toolkit"
6 trafgen \- a fast, multithreaded network packet generator
10 \fBtrafgen\fR [\fIoptions\fR] [\fIpacket\fR]
14 trafgen is a fast, zero-copy network traffic generator for debugging,
15 performance evaluation, and fuzz-testing. trafgen utilizes the packet(7)
16 socket interface of Linux which postpones complete control over packet data
17 and packet headers into the user space. It has a powerful packet configuration
18 language, which is rather low-level and not limited to particular protocols.
19 Thus, trafgen can be used for many purposes. Its only limitation is that it
20 cannot mimic full streams resp. sessions. However, it is very useful for
21 various kinds of load testing in order to analyze and subsequently improve
22 systems behaviour under DoS attack scenarios, for instance.
24 trafgen is Linux specific, meaning there is no support for other operating
25 systems, same as netsniff-ng(8), thus we can keep the code footprint quite
26 minimal and to the point. trafgen makes use of packet(7) socket's TX_RING
27 interface of the Linux kernel, which is a mmap(2)'ed ring buffer shared between
28 user and kernel space.
30 By default, trafgen starts as many processes as available CPUs, pins each
31 of them to their respective CPU and sets up the ring buffer each in their own
32 process space after having compiled a list of packets to transmit. Thus, this is
33 likely the fastest one can get out of the box in terms of transmission performance
34 from user space, without having to load unsupported or non-mainline third-party
35 kernel modules. On Gigabit Ethernet, trafgen has a comparable performance to
36 pktgen, the built-in Linux kernel traffic generator, except that trafgen is more
37 flexible in terms of packet configuration possibilities. On 10-Gigabit-per-second
38 Ethernet, trafgen might be slower than pktgen due to the user/kernel space
39 overhead but still has a fairly high performance for out of the box kernels.
41 trafgen has the potential to do fuzz testing, meaning a packet configuration can
42 be built with random numbers on all or certain packet offsets that are freshly
43 generated each time a packet is sent out. With a built-in IPv4 ping, trafgen can
44 send out an ICMP probe after each packet injection to the remote host in order
45 to test if it is still responsive/alive. Assuming there is no answer from the
46 remote host after a certain threshold of probes, the machine is considered dead
47 and the last sent packet is printed together with the random seed that was used
48 by trafgen. You might not really get lucky fuzz-testing the Linux kernel, but
49 presumably there are buggy closed-source embedded systems or network driver's
50 firmware files that are prone to bugs, where trafgen could help in finding them.
52 trafgen's configuration language is quite powerful, also due to the fact, that
53 it supports C preprocessor macros. A stddef.h is being shipped with trafgen for
54 this purpose, so that well known defines from Linux kernel or network programming
55 can be reused. After a configuration file has passed the C preprocessor stage,
56 it is processed by the trafgen packet compiler. The language itself supports a
57 couple of features that are useful when assembling packets, such as built-in
58 runtime checksum support for IP, UDP and TCP. Also it has an expression evaluator
59 where arithmetic (basic operations, bit operations, bit shifting, ...) on constant
60 expressions is being reduced to a single constant on compile time. Other features
61 are ''fill'' macros, where a packet can be filled with n bytes by a constant, a
62 compile-time random number or run-time random number (as mentioned with fuzz
63 testing). Also, netsniff-ng(8) is able to convert a pcap file into a trafgen
64 configuration file, thus such a configuration can then be further tweaked for a
69 .SS -i <cfg|pcap|->, -c <cfg|->, --in <cfg|pcap|->, --conf <cfg|->
70 Defines the input configuration file that can either be passed as a normal plain
71 text file or via stdin (''-''). Note that currently, if a configuration is
72 passed through stdin, only 1 CPU will be used.
73 It is also possible to specify PCAP file with .pcap extension via -i,--in option,
74 by default packets will be sent at rate considering timestamp from PCAP file which
75 might be reset via -b/-t options.
77 .SS -o <dev|pcap>, -d <dev|pcap>, --out <dev|pcap>, --dev <dev|pcap>
78 Defines the outgoing networking device such as eth0, wlan0 and others or
82 Pass the packet configuration to the C preprocessor before reading it into
83 trafgen. This allows #define and #include directives (e.g. to include
84 definitions from system headers) to be used in the trafgen configuration file.
86 .SS -D <name>=<definition>, --define <name>=<definition>
87 Add macro definition for the C preprocessor to use it within trafgen file. This
88 option is used in combination with the -p,--cpp option.
90 .SS -J, --jumbo-support
91 By default trafgen's ring buffer frames are of a fixed size of 2048 bytes.
92 This means that if you're expecting jumbo frames or even super jumbo frames to
93 pass your line, then you will need to enable support for that with the help of
94 this option. However, this has the disadvantage of a performance regression and
95 a bigger memory footprint for the ring buffer.
98 In case the output networking device is a wireless device, it is possible with
99 trafgen to turn this into monitor mode and create a mon<X> device that trafgen
100 will be transmitting on instead of wlan<X>, for instance. This enables trafgen
101 to inject raw 802.11 frames.
103 .SS -s <ipv4>, --smoke-test <ipv4>
104 In case this option is enabled, trafgen will perform a smoke test. In other
105 words, it will probe the remote end, specified by an <ipv4> address, that is
106 being ''attacked'' with trafgen network traffic, if it is still alive and
107 responsive. That means, after each transmitted packet that has been configured,
108 trafgen sends out ICMP echo requests and waits for an answer before it continues.
109 In case the remote end stays unresponsive, trafgen assumes that the machine
110 has crashed and will print out the content of the last packet as a trafgen
111 packet configuration and the random seed that has been used in order to
112 reproduce a possible bug. This might be useful when testing proprietary embedded
113 devices. It is recommended to have a direct link between the host running
114 trafgen and the host being attacked by trafgen.
116 .SS -n <0|uint>, --num <0|uint>
117 Process a number of packets and then exit. If the number of packets is 0, then
118 this is equivalent to infinite packets resp. processing until interrupted.
119 Otherwise, a number given as an unsigned integer will limit processing.
122 Randomize the packet selection of the configuration file. By default, if more
123 than one packet is defined in a packet configuration, packets are scheduled for
124 transmission in a round robin fashion. With this option, they are selected
127 .SS -P <uint>, --cpus <uint>
128 Specify the number of processes trafgen shall fork(2) off. By default trafgen
129 will start as many processes as CPUs that are online and pin them to each,
130 respectively. Allowed value must be within interval [1,CPUs].
132 .SS -t <time>, --gap <time>
133 Specify a static inter-packet timegap in seconds, milliseconds, microseconds,
134 or nanoseconds: ''<num>s/ms/us/ns''. If no postfix is given default to
135 microseconds. If this option is given, then instead of packet(7)'s TX_RING
136 interface, trafgen will use sendto(2) I/O for network packets, even if the
137 <time> argument is 0. This option is useful for a couple of reasons: i)
138 comparison between sendto(2) and TX_RING performance, ii) low-traffic packet
139 probing for a given interval, iii) ping-like debugging with specific payload
140 patterns. Furthermore, the TX_RING interface does not cope with interpacket
143 .SS -b <rate>, --rate <rate>
144 Specify the packet send rate <num>pps/B/kB/MB/GB/kbit/Mbit/Gbit/KiB/MiB/GiB units.
145 Like with the -t,--gap option, the packets are sent in slow mode.
147 .SS -S <size>, --ring-size <size>
148 Manually define the TX_RING resp. TX_RING size in ''<num>KiB/MiB/GiB''. On
149 default the size is being determined based on the network connectivity rate.
151 .SS -E <uint>, --seed <uint>
152 Manually set the seed for pseudo random number generator (PRNG) in trafgen. By
153 default, a random seed from /dev/urandom is used to feed glibc's PRNG. If that
154 fails, it falls back to the unix timestamp. It can be useful to set the seed
155 manually in order to be able to reproduce a trafgen session, e.g. after fuzz
158 .SS -u <uid>, --user <uid> resp. -g <gid>, --group <gid>
159 After ring setup, drop privileges to a non-root user/group combination.
162 Set this process as a high priority process in order to achieve a higher
163 scheduling rate resp. CPU time. This is however not the default setting, since
164 it could lead to starvation of other processes, for example low priority kernel
167 .SS -A, --no-sock-mem
168 Do not change systems default socket memory setting during testrun.
169 Default is to boost socket buffer memory during the test to:
171 /proc/sys/net/core/rmem_default:4194304
172 /proc/sys/net/core/wmem_default:4194304
173 /proc/sys/net/core/rmem_max:104857600
174 /proc/sys/net/core/wmem_max:104857600
176 .SS -Q, --notouch-irq
177 Do not reassign the NIC's IRQ CPU affinity settings.
180 Since Linux 3.14, the kernel supports a socket option PACKET_QDISC_BYPASS,
181 which trafgen enables by default. This options disables the qdisc bypass,
182 and uses the normal send path through the kernel's qdisc (traffic control)
183 layer, which can be usefully for testing the qdisc path.
186 Let trafgen be more talkative and let it print the parsed configuration and
187 some ring buffer statistics.
190 Show a built-in packet configuration example. This might be a good starting
191 point for an initial packet configuration scenario.
193 .SS -C, --no-cpu-stats
194 Do not print CPU time statistics on exit.
197 Show version information and exit.
200 Show user help and exit.
204 trafgen's packet configuration syntax is fairly simple. The very basic things
205 one needs to know is that a configuration file is a simple plain text file
206 where packets are defined. It can contain one or more packets. Packets are
207 enclosed by opening '{' and closing '}' braces, for example:
209 { /* packet 1 content goes here ... */ }
210 { /* packet 2 content goes here ... */ }
212 Alternatively, packets can also be specified directly on the command line, using
213 the same syntax as used in the configuration files.
215 When trafgen is started using multiple CPUs (default), then each of those packets
216 will be scheduled for transmission on all CPUs by default. However, it is possible
217 to tell trafgen to schedule a packet only on a particular CPU:
219 cpu(1): { /* packet 1 content goes here ... */ }
220 cpu(2-3): { /* packet 2 content goes here ... */ }
222 Thus, in case we have a 4 core machine with CPU0-CPU3, packet 1 will be scheduled
223 only on CPU1, packet 2 on CPU2 and CPU3. When using trafgen with \-\-num option,
224 then these constraints will still be valid and the packet is fairly distributed
227 Packet content is delimited either by a comma or whitespace, or both:
229 { 0xca, 0xfe, 0xba 0xbe }
231 Packet content can be of the following:
235 binary: 0b11110000, b11110000
238 string: "hello world"
239 shellcode: "\\x31\\xdb\\x8d\\x43\\x17\\x99\\xcd\\x80\\x31\\xc9"
241 Thus, a quite useless packet configuration might look like this (one can verify
242 this when running this with trafgen in combination with \-V):
244 { 0xca, 42, 0b11110000, 011, 'a', "hello world",
245 "\\x31\\xdb\\x8d\\x43\\x17\\x99\\xcd\\x80\\x31\\xc9" }
247 There are a couple of helper functions in trafgen's language to make life easier
248 to write configurations:
250 .B i) Fill with garbage functions:
252 byte fill function: fill(<content>, <times>): fill(0xca, 128)
253 compile-time random: rnd(<times>): rnd(128), rnd()
254 runtime random numbers: drnd(<times>): drnd(128), drnd()
255 compile-time counter: seqinc(<start-val>, <increment>, <times>)
256 seqdec(<start-val>, <decrement>, <times>)
257 runtime counter (1byte): dinc(<min-val>, <max-val>, <increment>)
258 ddec(<min-val>, <max-val>, <decrement>)
260 .B ii) Checksum helper functions (packet offsets start with 0):
262 IP/ICMP checksum: csumip/csumicmp(<off-from>, <off-to>)
263 UDP checksum: csumudp(<off-iphdr>, <off-udpdr>)
264 TCP checksum: csumtcp(<off-iphdr>, <off-tcphdr>)
265 UDP checksum (IPv6): csumudp6(<off-ip6hdr>, <off-udpdr>)
266 TCP checksum (IPv6): csumtcp6(<off-ip6hdr>, <off-tcphdr>)
268 .B iii) Multibyte functions, compile-time expression evaluation:
270 const8(<content>), c8(<content>), const16(<content>), c16(<content>),
271 const32(<content>), c32(<content>), const64(<content>), c64(<content>)
273 These functions write their result in network byte order into the packet
274 configuration, e.g. const16(0xaa) will result in ''00 aa''. Within c*()
275 functions, it is possible to do some arithmetics: -,+,*,/,%,&,|,<<,>>,^
276 E.g. const16((((1<<8)+0x32)|0b110)*2) will be evaluated to ''02 6c''.
278 .B iv) Protocol header functions:
280 The protocol header functions allow to fill protocol header fields by
281 using following generic syntax:
284 <proto>(<field>=<value>,<field2>=<value2>,...,<field3>,...)
289 If a field is not specified, then a default value will be used (usually 0).
290 Protocol fields might be set in any order. However, the offset of the fields in
291 the resulting packet is according to the respective protocol.
293 Each field might be set with a function which generates field value at runtime by
294 increment or randomize it. For L3/L4 protocols the checksum is calculated automatically
295 if the field was changed dynamically by specified function. The following field
296 functions are supported:
300 - increment field value at runtime. By default increment step is '1'.
304 parameters are used to increment field only in the specified range, by default original
305 field value is used. If the field length is greater than 4 then last 4 bytes are
306 incremented only (useful for MAC and IPv6 addresses):
309 <field> = dinc() | dinc(min, max) | dinc(min, max, step)
313 - randomize field value at runtime.
317 parameters are used to randomize field only in the specified range:
320 <field> = drnd() | drnd(min, max)
323 Example of using dynamic functions:
327 eth(saddr=aa:bb:cc:dd:ee:ff, saddr=dinc()),
329 udp(sport=dinc(1, 13, 2), dport=drnd(80, 100))
336 Fields might be further manipulated with a function at a specific offset:
339 <field>[<index>] | <field>[<index>:<length>]
342 <index> - relative field offset with range 0..<field.len> - 1
344 <length> - length/size of the value which will be set; either 1, 2 or 4 bytes (default: 1)
347 The <index> starts from the field's first byte in network order.
349 The syntax is similar to the one used in pcap filters (man pcap-filter) for
350 matching header field at a specified offset.
352 Examples of using field offset (showing the effect in a shortenet output from
356 1) trafgen -o lo --cpus 1 -n 3 '{ eth(da=11:22:33:44:55:66, da[0]=dinc()), tcp() }'
359 [ Eth MAC (00:00:00:00:00:00 => 11:22:33:44:55:66)
361 [ Eth MAC (00:00:00:00:00:00 => 12:22:33:44:55:66)
363 [ Eth MAC (00:00:00:00:00:00 => 13:22:33:44:55:66)
366 2) trafgen -o lo --cpus 1 -n 3 '{ ipv4(da=1.2.3.4, da[0]=dinc()), tcp() }'
369 [ IPv4 Addr (127.0.0.1 => 1.2.3.4)
371 [ IPv4 Addr (127.0.0.1 => 2.2.3.4)
373 [ IPv4 Addr (127.0.0.1 => 3.2.3.4)
380 All required lower layer headers will be filled automatically if they were not
381 specified by the user. The headers will be filled in the order they were
382 specified. Each header will be filled with some mimimum required set of fields.
386 Supported protocol headers:
390 .B eth(da=<mac>, sa=<mac>, type=<number>)
394 - Destination MAC address (default: 00:00:00:00:00:00)
397 - Source MAC address (default: device MAC address)
399 .B etype|type|prot|proto
400 - Ethernet type (default: 0)
404 .I PAUSE (IEEE 802.3X)
406 .B pause(code=<number>, time=<number>)
410 - MAC Control opcode (default: 0x0001)
413 - Pause time (default: 0)
415 By default Ethernet header is added with a fields:
418 Ethernet type - 0x8808
420 Destination MAC address - 01:80:C2:00:00:01
428 .B pfc(pri|prio(<number>)=<number>, time(<number>)=<number>)
432 - MAC Control opcode (default: 0x0101)
435 - Priority enable vector (default: 0)
437 .B pri|prio(<number>)
438 - Enable/disable (0 - disable, 1 - enable) pause for priority <number> (default: 0)
441 - Set pause time for priority <number> (default: 0)
443 By default Ethernet header is added with a fields:
446 Ethernet type - 0x8808
448 Destination MAC address - 01:80:C2:00:00:01
454 .B vlan(tpid=<number>, id=<number>, dei=<number>, tci=<number>, pcp=<number>, 1q, 1ad)
458 - Tag Protocol Identifier (TPID) (default: 0x8100)
461 - Tag Control Information (TCI) field (VLAN Id + PCP + DEI) (default: 0)
464 - Drop Eligible Indicator (DEI), formerly Canonical Format Indicator (CFI) (default: 0)
467 - Priority code point (PCP) (default: 0)
470 - VLAN Identifier (default: 0)
473 - Set 802.1q header (TPID: 0x8100)
476 - Set 802.1ad header (TPID: 0x88a8)
479 By default, if the lower level header is Ethernet, its EtherType is set to
485 .B mpls(label=<number>, tc|exp=<number>, last=<number>, ttl=<number>)
489 - MPLS label value (default: 0)
492 - Traffic Class for QoS field (default: 0)
495 - Bottom of stack S-flag (default: 1 for most last label)
498 - Time To Live (TTL) (default: 0)
501 By default, if the lower level header is Ethernet, its EtherType is set to
502 0x8847 (MPLS Unicast). S-flag is set automatically to 1 for the last label and
503 resets to 0 if the lower MPLS label was added after.
508 .B arp(htype=<number>, ptype=<number>, op=<request|reply|number>, request,
509 .B reply, smac=<mac>, sip=<ip4_addr>, tmac=<mac>, tip=<ip4_addr>)
513 - ARP hardware type (default: 1 [Ethernet])
516 - ARP protocol type (default: 0x0800 [IPv4])
519 - ARP operation type (request/reply) (default: request)
522 - ARP Request operation type
525 - ARP Reply operation type
528 - Sender hardware (MAC) address (default: device MAC address)
531 - Sender protocol (IPv4) address (default: device IPv4 address)
534 - Target hardware (MAC) address (default: 00:00:00:00:00:00)
537 - Target protocol (IPv4) address (default: device IPv4 address)
540 By default, the ARP operation field is set to request and the Ethernet
541 destination MAC address is set to the broadcast address (ff:ff:ff:ff:ff:ff).
545 .B ip4|ipv4(ihl=<number>, ver=<number>, len=<number>, csum=<number>,
546 .B ttl=<number>, tos=<number>, dscp=<number>, ecn=<number>,
548 .B id=<number>, flags=<number>, frag=<number>, df, mf, da=<ip4_addr>, sa=<ip4_addr>,
554 - Version field (default: 4)
557 - Header length in number of 32-bit words (default: 5)
560 - Type of Service (ToS) field (default: 0)
563 - Differentiated Services Code Point (DSCP, DiffServ) field (default: 0)
566 - Explicit Congestion Notification (ECN) field (default: 0)
569 - Total length of header and payload (calculated by default)
572 - IPv4 datagram identification (default: 0)
575 - IPv4 flags value (DF, MF) (default: 0)
578 - Don't fragment (DF) flag (default: 0)
581 - More fragments (MF) flag (default: 0)
584 - Fragment offset field in number of 8 byte blocks (default: 0)
587 - Time to live (TTL) field (default: 0)
590 - Header checksum (calculated by default)
593 - Source IPv4 address (default: device IPv4 address)
596 - Destination IPv4 address (default: 0.0.0.0)
599 - IPv4 protocol number (default: 0)
602 By default, if the lower level header is Ethernet, its EtherType field is set to
603 0x0800 (IPv4). If the lower level header is IPv4, its protocol field is set to
608 .B ip6|ipv6(ver=<number>, class=<number>, flow=<number> len=<number>,
609 .B nexthdr=<number>, hoplimit=<number>,
611 .B da=<ip6_addr>, sa=<ip6_addr>)
616 - Version field (default: 6)
619 - Traffic class (default: 0)
622 - Flow label (default: 0)
625 - Payload length (calculated by default)
628 - Type of next header, i.e. transport layer protocol number (default: 0)
631 - Hop limit, i.e. time to live (default: 0)
634 - Source IPv6 address (default: device IPv6 address)
637 - Destination IPv6 address (default: 0:0:0:0:0:0:0:0)
640 By default, if the lower level header is Ethernet, its EtherType field is set to
645 .B icmp4|icmpv4(type=<number>, code=<number>, echorequest, echoreply,
646 .B csum=<number>, mtu=<number>, seq=<number>, id=<number>, addr=<ip4_addr>)
650 - Message type (default: 0 - Echo reply)
653 - Message code (default: 0)
656 - ICMPv4 echo (ping) request (type: 8, code: 0)
659 - ICMPv4 echo (ping) reply (type: 0, code: 0)
662 - Checksum of ICMPv4 header and payload (calculated by default)
665 - Next-hop MTU field used in 'Datagram is too big' message type (default; 0)
668 - Sequence number used in Echo/Timestamp/Address mask messages (default: 0)
671 - Identifier used in Echo/Timestamp/Address mask messages (default: 0)
674 - IPv4 address used in Redirect messages (default: 0.0.0.0)
677 Example ICMP echo request (ping):
680 { icmpv4(echorequest, seq=1, id=1326) }
685 .B icmp6|icmpv6(type=<number>, echorequest, echoreply, code=<number>,
690 - Message type (default: 0)
696 - ICMPv6 echo (ping) request
699 - ICMPv6 echo (ping) reply
702 - Message checksum (calculated by default)
705 By default, if the lower level header is IPv6, its Next Header field is set to
710 .B udp(sp=<number>, dp=<number>, len=<number>, csum=<number>)
714 - Source port (default: 0)
717 - Destination port (default: 0)
720 - Length of UDP header and data (calculated by default)
723 - Checksum field over IPv4 pseudo header (calculated by default)
726 By default, if the lower level header is IPv4, its protocol field is set to
731 .B tcp(sp=<number>, dp=<number>, seq=<number>, aseq|ackseq=<number>, doff|hlen=<number>,
732 .B cwr, ece|ecn, urg, ack, psh, rst, syn, fin, win|window=<number>, csum=<number>,
737 - Source port (default: 0)
740 - Destination port (default: 0)
743 - Sequence number (default: 0)
746 - Acknowledgement number (default: 0)
749 - Header size (data offset) in number of 32-bit words (default: 5)
752 - Congestion Window Reduced (CWR) flag (default: 0)
755 - ECN-Echo (ECE) flag (default: 0)
758 - Urgent flag (default: 0)
761 - Acknowledgement flag (default: 0)
764 - Push flag (default: 0)
767 - Reset flag (default: 0)
770 - Synchronize flag (default: 0)
773 - Finish flag (default: 0)
776 - Receive window size (default: 0)
779 - Checksum field over IPv4 pseudo header (calculated by default)
782 - Urgent pointer (default: 0)
785 By default, if the lower level header is IPv4, its protocol field is set to
788 Simple example of a UDP Echo packet:
792 eth(da=11:22:33:44:55:66),
799 Furthermore, there are two types of comments in trafgen configuration files:
801 1. Multi-line C-style comments: /* put comment here */
802 2. Single-line Shell-style comments: # put comment here
804 Next to all of this, a configuration can be passed through the C preprocessor
805 before the trafgen compiler gets to see it with option \-\-cpp. To give you a
806 taste of a more advanced example, run ''trafgen \-e'', fields are commented:
808 /* Note: dynamic elements make trafgen slower! */
812 /* MAC Destination */
813 fill(0xff, ETH_ALEN),
815 0x00, 0x02, 0xb3, drnd(3),
818 /* IPv4 Version, IHL, TOS */
824 /* IPv4 Flags, Frag Off */
830 /* IPv4 Checksum (IP header from, to) */
836 /* TCP Source Port */
840 /* TCP Sequence Number */
842 /* TCP Ackn. Number */
844 /* TCP Header length + TCP SYN/ECN Flag */
845 c16((8 << 12) | TCP_FLAG_SYN | TCP_FLAG_ECE)
848 /* TCP Checksum (offset IP, offset TCP) */
851 0x00, 0x00, 0x01, 0x01, 0x08, 0x0a, 0x06,
852 0x91, 0x68, 0x7d, 0x06, 0x91, 0x68, 0x6f,
857 Another real-world example by Jesper Dangaard Brouer [1]:
860 # --- ethernet header ---
861 0x00, 0x1b, 0x21, 0x3c, 0x9d, 0xf8, # mac destination
862 0x90, 0xe2, 0xba, 0x0a, 0x56, 0xb4, # mac source
863 const16(0x0800), # protocol
865 # ipv4 version (4-bit) + ihl (4-bit), tos
869 # id (note: runtime dynamic random)
871 # ipv4 3-bit flags + 13-bit fragment offset
872 # 001 = more fragments
876 # dynamic ip checksum (note: offsets are zero indexed)
878 192, 168, 51, 1, # source ip
879 192, 168, 51, 2, # dest ip
881 # as this is a fragment the below stuff does not matter too much
882 const16(48054), # src port
883 const16(43514), # dst port
884 const16(20), # udp length
885 # udp checksum can be dyn calc via csumudp(offset ip, offset tcp)
886 # which is csumudp(14, 34), but for udp its allowed to be zero
892 [1] https://marc.info/?l=linux-netdev&m=135903630614184
894 The above example rewritten using the header generation functions:
897 # --- ethernet header ---
898 eth(da=00:1b:21:3c:9d:f8, da=90:e2:ba:0a:56:b4)
900 ipv4(id=drnd(), mf, ttl=64, sa=192.168.51.1, da=192.168.51.2)
902 udp(sport=48054, dport=43514, csum=0)
909 .SS trafgen --dev eth0 --conf trafgen.cfg
910 This is the most simple and, probably, the most common use of trafgen. It
911 will generate traffic defined in the configuration file ''trafgen.cfg'' and
912 transmit this via the ''eth0'' networking device. All online CPUs are used.
914 .SS trafgen -e | trafgen -i - -o lo --cpp -n 1
915 This is an example where we send one packet of the built-in example through
916 the loopback device. The example configuration is passed via stdin and also
917 through the C preprocessor before trafgen's packet compiler will see it.
919 .SS trafgen --dev eth0 --conf fuzzing.cfg --smoke-test 10.0.0.1
920 Read the ''fuzzing.cfg'' packet configuration file (which contains drnd()
921 calls) and send out the generated packets to the ''eth0'' device. After each
922 sent packet, ping probe the attacked host with address 10.0.0.1 to check if
923 it's still alive. This also means, that we utilize 1 CPU only, and do not
924 use the TX_RING, but sendto(2) packet I/O due to ''slow mode''.
926 .SS trafgen --dev wlan0 --rfraw --conf beacon-test.txf -V --cpus 2
927 As an output device ''wlan0'' is used and put into monitoring mode, thus we
928 are going to transmit raw 802.11 frames through the air. Use the
929 ''beacon-test.txf'' configuration file, set trafgen into verbose mode and
932 .SS trafgen --dev em1 --conf frag_dos.cfg --rand --gap 1000us
933 Use trafgen in sendto(2) mode instead of TX_RING mode and sleep after each
934 sent packet a static timegap for 1000us. Generate packets from ''frag_dos.cfg''
935 and select next packets to send randomly instead of a round-robin fashion.
936 The output device for packets is ''em1''.
938 .SS trafgen --dev eth0 --conf icmp.cfg --rand --num 1400000 -k1000
939 Send only 1400000 packets using the ''icmp.cfg'' configuration file and then
940 exit trafgen. Select packets randomly from that file for transmission and
941 send them out via ''eth0''. Also, trigger the kernel every 1000us for batching
942 the ring frames from user space (default is 10us).
944 .SS trafgen --dev eth0 --conf tcp_syn.cfg -u `id -u bob` -g `id -g bob`
945 Send out packets generated from the configuration file ''tcp_syn.cfg'' via
946 the ''eth0'' networking device. After setting up the ring for transmission,
947 drop credentials to the non-root user/group bob/bob.
949 .SS trafgen --dev eth0 '{ fill(0xff, 6), 0x00, 0x02, 0xb3, rnd(3), c16(0x0800), fill(0xca, 64) }' -n 1
950 Send out 1 invaid IPv4 packet built from command line to all hosts.
954 trafgen can saturate a Gigabit Ethernet link without problems. As always,
955 of course, this depends on your hardware as well. Not everywhere where it
956 says Gigabit Ethernet on the box, will you reach almost physical line rate!
957 Please also read the netsniff-ng(8) man page, section NOTE for further
958 details about tuning your system e.g. with tuned(8).
960 If you intend to use trafgen on a 10-Gbit/s Ethernet NIC, make sure you
961 are using a multiqueue tc(8) discipline, and make sure that the packets
962 you generate with trafgen will have a good distribution among tx_hashes
963 so that you'll actually make use of multiqueues.
965 For introducing bit errors, delays with random variation and more, there
966 is no built-in option in trafgen. Rather, one should reuse existing methods
967 for that which integrate nicely with trafgen, such as tc(8) with its
968 different disciplines, i.e. netem.
970 For more complex packet configurations, it is recommended to use high-level
971 scripting for generating trafgen packet configurations in a more automated
972 way, i.e. also to create different traffic distributions that are common for
973 industrial benchmarking:
975 Traffic model Distribution
977 IMIX 64:7, 570:4, 1518:1
978 Tolly 64:55, 78:5, 576:17, 1518:23
979 Cisco 64:7, 594:4, 1518:1
980 RPR Trimodal 64:60, 512:20, 1518:20
981 RPR Quadrimodal 64:50, 512:15, 1518:15, 9218:20
983 The low-level nature of trafgen makes trafgen rather protocol independent
984 and therefore useful in many scenarios when stress testing is needed, for
985 instance. However, if a traffic generator with higher level packet
986 descriptions is desired, netsniff-ng's mausezahn(8) can be of good use as
989 For smoke/fuzz testing with trafgen, it is recommended to have a direct
990 link between the host you want to analyze (''victim'' machine) and the host
991 you run trafgen on (''attacker'' machine). If the ICMP reply from the victim
992 fails, we assume that probably its kernel crashed, thus we print the last
993 sent packet together with the seed and quit probing. It might be very unlikely
994 to find such a ping-of-death on modern Linux systems. However, there might
995 be a good chance to find it on some proprietary (e.g. embedded) systems or
996 buggy driver firmwares that are in the wild. Also, fuzz testing can be done
997 on raw 802.11 frames, of course. In case you find a ping-of-death, please
998 mention that you were using trafgen in your commit message of the fix!
1001 For old trafgen versions only, there could occur kernel crashes: we have fixed
1002 this bug in the mainline and stable kernels under commit 7f5c3e3a8 (''af_packet:
1003 remove BUG statement in tpacket_destruct_skb'') and also in trafgen.
1005 Probably the best is if you upgrade trafgen to the latest version.
1008 trafgen is licensed under the GNU GPL version 2.0.
1012 was originally written for the netsniff-ng toolkit by Daniel Borkmann. It
1013 is currently maintained by Tobias Klauser <tklauser@distanz.ch> and Daniel
1014 Borkmann <dborkma@tik.ee.ethz.ch>.
1017 .BR netsniff-ng (8),
1022 .BR astraceroute (8),
1026 Manpage was written by Daniel Borkmann.
1029 This page is part of the Linux netsniff-ng toolkit project. A description of the project,
1030 and information about reporting bugs, can be found at http://netsniff-ng.org/.