diff options
| -rw-r--r-- | mausezahn.8 | 256 |
1 files changed, 256 insertions, 0 deletions
diff --git a/mausezahn.8 b/mausezahn.8 new file mode 100644 index 0000000..1c89b29 --- /dev/null +++ b/mausezahn.8 @@ -0,0 +1,256 @@ +.\" netsniff-ng - the packet sniffing beast +.\" Copyright 2013 Herbert Haas, modified by Daniel Borkmann. +.\" Subject to the GPL, version 2. + +.TH MAUSEZAHN 8 "03 March 2013" "Linux" "netsniff-ng toolkit" +.SH NAME +mausezahn \- a fast versatile packet generator with Cisco-cli + +.SH SYNOPSIS + +\fB mausezahn\fR { [\fIoptions\fR] "<arg-string> | <hex-string>" } + +.SH DESCRIPTION + +mausezahn is a fast traffic generator which allows you to send nearly every +possible and impossible packet. In contrast to trafgen(8), mausezahn's packet +configuration is on protocol-level instead of byte-level and mausezahn also +comes with a built-in Cisco-like command-line interface, making it suitable +as a network traffic generator box in your network lab. + +Next to network labs, it can also be used as a didactical tool and for security +audits including penetration and DoS testing. As a traffic generator, mausezahn +is also able to test IP multicast or VoIP networks. Packet rates close to the +physical limit are reachable, depending on the hardware platform. + +mausezahn supports two modes, ``direct mode'' and a multi-threaded ``interactive +mode''. + +The ``direct mode'' allows you to create a packet directly on the command line +and every packet parameter is specified in the argument list when calling +mausezahn. + +The ``interactive mode'' is an advanced multi-threaded configuration mode with +its own command line interface (cli). This mode allows you to create an arbitrary +number of packet types and streams in parallel, each with different parameters. + +The interactive mode utilizes a completely redesigned and more flexible protocol +framework called ``mops'' (mausezahn's own packet system). The look and feel of +the cli is very close to the Cisco IOS^tm command line. + +You can start the interactive mode by executing mausezahn with the ``-x'' +argument (an optional port number may follow, otherwise it is 25542). Then use +telnet(1) to connect to this mausezahn instance. If not otherwise specified, +the default login/password combination is mz:mz, enable password is: mops. +This can be changed in /etc/netsniff-ng/mausezahn.conf. + +The direct mode supports two specification schemes: The ``raw-layer-2'' scheme, +where every single byte to be sent can be specified, and ``higher-layer'' scheme, +where packet builder interfaces are used (using the ``-t'' option). + +To use the ``raw-layer-2'' scheme, simply specify the desired frame as +hexadecimal sequence (the ``hex-string''), such as: + + mausezahn eth0 "00:ab:cd:ef:00 00:00:00:00:00:01 08:00 ca:fe:ba:be" + +In this example, whitespaces within the byte string are optional and separate +the Ethernet fields (destination and source address, type field, and a short +payload). The only additional options supported are ``-a'', ``-b'', ``-c'', and +``-p''. The frame length must be greater or equal 15 bytes. + +The ``higher-layer'' scheme is enabled using the ``-t <packet-type>'' option. +This option activates a packet builder and besides the ``packet-type'' an +optional ``arg-string'' can be specified. The ``arg-string'' contains +packet-specific parameters, such as TCP flags, port numbers, etc (see example +section). + +.SH OPTIONS +mausezahn provides a built-in context-specific help. Thus, simply append the +keyword ``help'' after the configuration options. The most important options +are: + +.SS -x [<port>] +Start mausezahn in interactive mode with a Cisco-like cli. Use telnet to log +into the local mausezahn instance. If no port has been specified, port 25542 +is used as default. + +.SS -v +Verbose mode. Capital -V is even more verbose. + +.SS -S +Simulation mode, i.e. don't put anything on the wire. This is typically combined +with the verbose mode. + +.SS -q +Quiet mode where only warnings and errors are displayed. + +.SS -c <count> +Send the packet count times (default: 1, infinite: 0). + +.SS -d <delay> +Apply delay between transmissions. The delay value can be specified in usec +(default, no additional unit needed), or in msec (e.g. 100m or 100msec), or +in seconds (e.g. 100s or 100sec). Note: mops also supports nanosecond delay +granulation if you need it (see interactive mode). + +.SS -p <lenght> +Pad the raw frame to specified length using zero bytes. Note that for raw +layer 2 frames the specified length defines the whole frame length, while for +higher layer packets the number of additional padding bytes are specified. + +.SS -a <src-mac|keyword> +Use specified source MAC address with hex notation such as 00:00:aa:bb:cc:dd. +By default the interface MAC address will be used. The keywords ``rand'' and +``own'' refer to a random MAC address (only unicast addresses are created) +and the own address, respectively. You can also use the keywords mentioned +below although broadcast-type source addresses are officially invalid. + +.SS -b <dst-mac|keyword> +Use specified destination MAC address. By default, a broadcast is sent in raw +layer 2 mode or the destination hosts/gateways interface MAC address in normal +(IP) mode. You can use the same keywords as mentioned above, as well as +``bc'' or ``bcast'', ``cisco'', and ``stp''. Please note that for the destination +MAC address the ``rand'' keyword is supported but creates a random address only +once, even when you send multiple packets. + +.SS -A <src-ip|range|rand> +Use specified source IP address, default is own interface IP. Optionally, the +keyword ``rand'' can again be used for a random source IP address or a range +can be specified, such as ``192.168.1.1-192.168.1.100'' or ``10.1.0.0/16''. +Also, a DNS name can be specified for which mausezahn tries to determine the +corresponding IP address automatically. + +.SS -B <dst-ip|range> +Use specified destination IP address (default is broadcast i.e. 255.255.255.255). +As with the source address (see above) you can also specify a range or a DNS name. + +.SS -t <packet-type> +Create the specified packet type using the built-in packet builder. Currently, +supported packet types are: ``arp'', ``bpdu'', ``ip'', ``udp'', ``tcp'', ``rtp'', +and ``dns''. There is currently also a limited support for ``icmp''. Type +``-t help'' to verify which packet builders your actual mausezahn version +supports. Also, for any particular packet type, for example ``tcp'' type +``mausezahn -t tcp help'' to receive a more in-depth context specific help. + +.SS -T <packet-type> +Make this mausezahn instance the receiving station. Currently, only ``rtp'' is +an option here and provides precise jitter measurements. For this purpose, start +another mausezahn instance on the sending station and the local receiving station +will output jitter statistics. See ``mausezahn \-T rtp help'' for a detailed help. + +.SS -Q <[CoS:]vlan> [, <[CoS:]vlan>, ...] +Specify 802.1Q VLAN tag and optional Class of Service. An arbitrary number of +VLAN tags can be specified (that is you can simulate QinQ or even QinQinQinQ..). +Multiple tags must be separated via a comma or a period (e.g. "5:10,20,2:30"). +VLAN tags are not supported for ARP and BPDU packets (in which case you could +specify the whole frame in hex using the raw layer 2 interface of mausezahn). + +.SS -M <label[:cos[:ttl]][bos]> [, <label...>] +Specify a MPLS label or even a MPLS label stack. Optionally, for each label the +experimental bits (usually the Class of Service, CoS) and the Time To Live +(TTL) can be specified. And if you are really crazy you can set/unset the +Bottom of Stack (BoS) bit at each label using the ``S'' (set) and ``s'' +(unset) option. By default, the BoS is set automatically and correct. Any other +setting will lead to invalid frames. Enter ``-M help'' for detailed instructions +and examples. + +.SS -P <ascii-payload> +Specify a cleartext payload. Alternatively, each packet type supports a +hexadecimal specification of the payload (see for example ``-t udp help''). + +.SS -f <filename> +Read the ascii payload from the specified file. + +.SS -F <filename> +Read the hex payload from the specified file. Actually, this file must be also +an ascii text file, but must contain hexadecimal digits, e.g. "aa:bb:cc:0f:e6...". +You can use also spaces as separation characters. + +.SH USAGE EXAMPLE + +.SS mausezahn eth0 \-c 0 \-d 2s \-t bpdu vlan=5 +Send BPDU frames for VLAN 5 as used with Cisco's PVST+ type of STP. By default +mausezahn assumes that you want to become the root bridge. + +.SS mausezahn eth0 \-c 128000 \-a rand \-p 64 +Perform a CAM table overflow attack. + +.SS mausezahn eth0 \-c 0 \-Q 5,100 \-t tcp "flags=syn,dp=1-1023" \-p 20 \-A rand \-B 10.100.100.0/24 +Perform a SYN flood attack to another VLAN using VLAN hopping. This only works +if you are connected to the same VLAN which is configured as native VLAN on the +trunk. We assume that the victim VLAN is VLAN 100 and the native VLAN is VLAN 5. +Lets attack every host in VLAN 100 which use a IP prefix of 10.100.100.0/24, also +try out all ports between 1 and 1023 and use a random source IP address. + +.SS mausezahn eth0 \-c 0 \-d 10msec \-B 230.1.1.1 \-t udp "dp=32000,dscp=46" \-P "Multicast test packet" +Send IP multicast packets to the multicast group 230.1.1.1 using a UDP header +with destination port 32000 and set the IP DSCP field to EF (46). Send one +frame every 10 msec. + +.SS mausezahn eth0 \-Q 6:420 \-M 100,200,300:5 \-A 172.30.0.0/16 \-B target.anynetwork.foo \-t udp "sp=666,dp=1-65535" \-p 1000 \-c 10 +Send UDP packets to the destination host target.anynetwork.foo using all +possible destination ports and send every packet with all possible source +addresses of the range 172.30.0.0/16; additionally use a source port of 666 +and three MPLS labels, 100, 200, and 300, the outer (300) with QoS field 5. +Send the frame with a VLAN tag 420 and CoS 6; eventually pad with 1000 bytes +and repeat the whole thing 10 times. + +.SS mausezahn \-t syslog sev=3 \-P "Main reactor reached critical temperature." \-A 192.168.33.42 \-B 10.1.1.9 \-c 6 \-d 10s +Send six forged syslog messages with severity 3 to a Syslog server 10.1.1.9; use +a forged source IP address 192.168.33.42 and let mausezahn decide which local +interface to use. Use an inter-packet delay of 10 seconds. + +.SS mausezahn \-t tcp "flags=syn|urg|rst, sp=145, dp=145, win=0, s=0-4294967295, ds=1500, urg=666" \-a bcast \-b bcast \-A bcast \-B 10.1.1.6 \-p 5 +Send an invalid TCP packet with only a 5 byte payload as layer-2 broadcast and +also use the broadcast MAC address as source address. The target should be +10.1.1.6 but use a broadcast source address. The source and destination port +shall be 145 and the window size 0. Set the TCP flags SYN, URG, and RST +simultaneously and sweep through the whole TCP sequence number space with an +increment of 1500. Finally set the urgent pointer to 666, i.e. pointing to +nowhere. + +.SH NOTE +When multiple ranges are specified, e.g. destination port ranges and +destination address ranges, then all possible combinations of ports and +addresses are used for packet generation. Furthermore, this can be mixed with +other ranges e.g. a TCP sequence number range. Note that combining ranges +can lead to a very huge number of frames to be sent. As a rule of thumb you +can assume that about 100,000 frames and more are sent in a fraction of one +second, depending on your network interface. + +mausezahn has been designed as fast traffic generator so you might easily +overwhelm a LAN segment with myriads of packets. And because mausezahn should +also support security audits it is also possible to create malicious or +invalid packets, SYN floods, port and address sweeps, DNS and ARP poisoning, +etc. + +Therefore, don't use this tool when you are not aware of possible consequences +or have only little knowledge about networks and data communication. If you +abuse mausezahn for 'unallowed' attacks and get caught, or damage something of +your own, then this is completely your fault. So the safest solution is to try +it out in a lab environment. + +.SH LEGAL +mausezahn is licensed under the GNU GPL version 2.0. + +.SH HISTORY +.B mausezahn +was originally written by Herbert Haas. According to his website [1], he +unfortunately passed away in 2011. Thus, having this tool unmaintained as well. +It has been adopted and integrated into the netsniff-ng toolkit and is further +being maintained and developed from there. Maintainers are Tobias Klauser +<tklauser@distanz.ch> and Daniel Borkmann <dborkma@tik.ee.ethz.ch>. + + [1] http://www.perihel.at/ + +.SH SEE ALSO +.BR netsniff-ng (8), +.BR trafgen (8), +.BR ifpps (8), +.BR bpfc (8), +.BR flowtop (8), +.BR astraceroute (8), +.BR curvetun (8) + +.SH AUTHOR +Manpage was written by Herbert Haas and modified by Daniel Borkmann. |