1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
|
.\" $OpenBSD: ipftest.1,v 1.11 1999/11/13 19:46:56 ericj Exp $
.Dd May 23, 1999
.Dt IPFTEST 1
.Os
.Sh NAME
.Nm ipftest
.Nd test packet filter rules with arbitrary input
.Sh SYNOPSIS
.Nm ipftest
.Op Fl vbdPSTEHX
.Op Fl I Ar interface
.Fl r
.Ar filename
.Op Fl i Ar filename
.Sh DESCRIPTION
With
.Nm
operators can see the effects of an
.Nm ipf
filter ruleset on test packets, rather than having to observe
the effects of the
ruleset on live traffic. This can reduce the disruptions experienced
during the development and refinement of secure IP environments.
.Pp
.Nm
reads test packets from
.Ar stdin
or the file specified by the
.Fl i
option, applies the ruleset specified by the
.Fl r
option to each, and generates information about the effect of the ruleset on
each packet to
.Ar stdout .
.Pp
Captured or handcrafted packets to be tested can be supplied
in a variety of formats. See the options
.Fl P , Fl S ,
.Fl T , Fl H
and
.Fl E
for details. In addition the
.Fl X
option gives
.Nm
the ability to use its own text description format to generate
.Dq fake
packets. The format used is:
.Bd -ragged
in|out on
.Ar if
.Op tcp|udp|icmp
.Ar srchost
.Op , Ar port
.Ar dsthost
.Op , Ar port
.Op Fl FSRPAU
.Ed
.Pp
This allows for input or output ICMP, TCP, or UDP packets to be generated for
any interface. For TCP or UDP it allows the specification of source and
destination ports. For TCP it allows the specification of TCP flags.
Some examples are:
.Bd -literal -offset indent
# a UDP packet coming in on le0
in on le0 udp 10.1.1.1,2210 10.2.1.5,23
# an IP packet coming in on le0 from localhost - hmm :)
in on le0 localhost 10.4.12.1
# a TCP packet going out of le0 with the SYN flag set.
out on le0 tcp 10.4.12.1,2245 10.1.1.1,23 S
.Ed
.Pp
The following options are available:
.Bl -tag -width Fl
.It Fl v
Verbose mode. This provides more information about which parts of rule
matching the packet passes and fails.
.It Fl d
Turn on filter rule debugging. Currently, this only shows what caused
the rule to not match in the IP header checking (addresses/netmasks, etc).
.It Fl b
Cause the output to be a one word description of the result of passing
the packet through the filter: pass, block or nomatch.
This is used in the regression testing.
.It Fl I Ar interface
Set the interface name (used in rule matching) to be the name supplied.
This is useful with the
.Fl P , Fl S
and
.Fl E
options, where it is
not otherwise possible to associate a packet with an interface. Normal
.Dq text packets
can override this setting.
.It Fl P
The input file is in
the binary format produced using libpcap
(i.e.,
.Xr tcpdump
version 3). Packets are read from this file as being input
(for rule purposes). An interface may be specified using
.Fl I .
.It Fl S
The input file is in
.Dq snoop
format (see RFC 1761). Packets are read
from this file and used as input from any interface. This is perhaps the
most useful input type, currently.
.It Fl T
The input file is text output from
.Xr tcpdump .
The text formats which
are currently supported are those which result from the following
.Xr tcpdump
option combinations:
.Bd -literal -offset indent
tcpdump -n
tcpdump -nq
tcpdump -nqt
tcpdump -nqtt
tcpdump -nqte
.Ed
.It Fl H
The input file is hex digits, representing the binary makeup of the
packets. No length correction is made if an incorrect length is put in
the IP header.
.It Fl X
The input file is composed of text descriptions of IP packets.
.It Fl E
The input file is text output from etherfind. The text formats which
are currently supported are those which result from the following etherfind
option combinations:
.Bd -literal -offset indent
etherfind -n
etherfind -n -t
.Ed
.It Fl i Ar filename
Specify the filename from which to take input. Default is stdin.
.It Fl r Ar filename
Specify the filename from which to read filter rules.
.El
.Sh SEE ALSO
.Xr ipf 5 ,
.Xr ipf 8 ,
.Xr tcpdump 8 ,
.Sh BUGS
Not all of the input formats are capable of introducing a
wide enough variety of packets to be useful in testing.
|
