tcprewrite edit language/rules
|Reported by:||aturner||Owned by:||aturner|
|Operating System:||Add to FAQ?:||no|
|Output of tcpreplay -V:|
Out of the openpacket.org mailing list, it was talked about having a simple language allowing people to edit packets in a human friendly language. I had the suggestion of doing something like:
Packet 57: # packet to modify Offset: 89 # byte offset starting from start of packet Direction: C2S # direction of packet Type: IPv4 # type of field Encoding: big_endian # encoding of new value Value: 192.168.2.34 # optional new value
Honestly the above kinda sucks for a variety of reasons- not easily parsed/generated, but the goal is clear, and honestly for something like this, it's most important that it's easy for newbies to be able to create these "rules" by hand. I definately don't want something over complicated like XML.
The other advantage of this is that it requires tcprewrite/libtcpedit to have minimal packet decoding logic. We don't care what the protocol is or how to decode it, the rule writer just tells us to go to some packet, jump to a given offset and write a new value using some kind of encoding (big/little endian, string, etc) After that, just apply the L3/L4 checksum calculations and we're done. It would also allow for generic packet editing- changing payload, ports, bit flags, etc.