trafgen (8) - Linux Manuals
trafgen: a fast, multithreaded network packet generator
NAME
trafgen - a fast, multithreaded network packet generatorSYNOPSIS
trafgen [options]
DESCRIPTION
trafgen is a fast, zero-copy network traffic generator for debugging, performance evaluation, and fuzz-testing. trafgen utilizes the packet(7) socket interface of Linux which postpones complete control over packet data and packet headers into the user space. It has a powerful packet configuration language, which is rather low-level and not limited to particular protocols. Thus, trafgen can be used for many purposes. Its only limitation is that it cannot mimic full streams resp. sessions. However, it is very useful for various kinds of load testing in order to analyze and subsequently improve systems behaviour under DoS attack scenarios, for instance.
trafgen is Linux specific, meaning there is no support for other operating systems, same as netsniff-ng(8), thus we can keep the code footprint quite minimal and to the point. trafgen makes use of packet(7) socket's TX_RING interface of the Linux kernel, which is a mmap(2)'ed ring buffer shared between user and kernel space.
By default, trafgen starts as many processes as available CPUs, pins each of them to their respective CPU and sets up the ring buffer each in their own process space after having compiled a list of packets to transmit. Thus, this is likely the fastest one can get out of the box in terms of transmission performance from user space, without having to load unsupported or non-mainline third-party kernel modules. On Gigabit Ethernet, trafgen has a comparable performance to pktgen, the built-in Linux kernel traffic generator, except that trafgen is more flexible in terms of packet configuration possibilities. On 10-Gigabit-per-second Ethernet, trafgen might be slower than pktgen due to the user/kernel space overhead but still has a fairly high performance for out of the box kernels.
trafgen has the potential to do fuzz testing, meaning a packet configuration can be built with random numbers on all or certain packet offsets that are freshly generated each time a packet is sent out. With a built-in IPv4 ping, trafgen can send out an ICMP probe after each packet injection to the remote host in order to test if it is still responsive/alive. Assuming there is no answer from the remote host after a certain threshold of probes, the machine is considered dead and the last sent packet is printed together with the random seed that was used by trafgen. You might not really get lucky fuzz-testing the Linux kernel, but presumably there are buggy closed-source embedded systems or network driver's firmware files that are prone to bugs, where trafgen could help in finding them.
trafgen's configuration language is quite powerful, also due to the fact, that it supports C preprocessor macros. A stddef.h is being shipped with trafgen for this purpose, so that well known defines from Linux kernel or network programming can be reused. After a configuration file has passed the C preprocessor stage, it is processed by the trafgen packet compiler. The language itself supports a couple of features that are useful when assembling packets, such as built-in runtime checksum support for IP, UDP and TCP. Also it has an expression evaluator where arithmetic (basic operations, bit operations, bit shifting, ...) on constant expressions is being reduced to a single constant on compile time. Other features are ''fill'' macros, where a packet can be filled with n bytes by a constant, a compile-time random number or run-time random number (as mentioned with fuzz testing). Also, netsniff-ng(8) is able to convert a pcap file into a trafgen configuration file, thus such a configuration can then be further tweaked for a given scenario.
OPTIONS
-i <cfg|->, -c <cfg|i>, --in <cfg|->, --conf <cfg|->
Defines the input configuration file that can either be passed as a normal plain text file or via stdin (''-''). Note that currently, if a configuration is passed through stdin, only 1 CPU will be used.-o <dev>, -d <dev>, --out <dev>, --dev <dev>
Defines the outgoing networking device such as eth0, wlan0 and others.-p, --cpp
Pass the packet configuration to the C preprocessor before reading it into trafgen. This allows #define and #include directives (e.g. to include definitions from system headers) to be used in the trafgen configuration file.-J, --jumbo-support
By default trafgen's ring buffer frames are of a fixed size of 2048 bytes. This means that if you're expecting jumbo frames or even super jumbo frames to pass your line, then you will need to enable support for that with the help of this option. However, this has the disadvantage of a performance regression and a bigger memory footprint for the ring buffer.-R, --rfraw
In case the output networking device is a wireless device, it is possible with trafgen to turn this into monitor mode and create a mon<X> device that trafgen will be transmitting on instead of wlan<X>, for instance. This enables trafgen to inject raw 802.11 frames.-s <ipv4>, --smoke-test <ipv4>
In case this option is enabled, trafgen will perform a smoke test. In other words, it will probe the remote end, specified by an <ipv4> address, that is being ''attacked'' with trafgen network traffic, if it is still alive and responsive. That means, after each transmitted packet that has been configured, trafgen sends out ICMP echo requests and waits for an answer before it continues. In case the remote end stays unresponsive, trafgen assumes that the machine has crashed and will print out the content of the last packet as a trafgen packet configuration and the random seed that has been used in order to reproduce a possible bug. This might be useful when testing proprietary embedded devices. It is recommended to have a direct link between the host running trafgen and the host being attacked by trafgen.-n <0|uint>, --num <0|uint>
Process a number of packets and then exit. If the number of packets is 0, then this is equivalent to infinite packets resp. processing until interrupted. Otherwise, a number given as an unsigned integer will limit processing.-r, --rand
Randomize the packet selection of the configuration file. By default, if more than one packet is defined in a packet configuration, packets are scheduled for transmission in a round robin fashion. With this option, they are selected randomly instread.-P <uint>, --cpus <uint>
Specify the number of processes trafgen shall fork(2) off. By default trafgen will start as many processes as CPUs that are online and pin them to each, respectively. Allowed value must be within interval [1,CPUs].-t <uint>, --gap <uint>
Specify a static inter-packet timegap in micro-seconds. If this option is given, then instead of packet(7)'s TX_RING interface, trafgen will use sendto(2) I/O for network packets, even if the <uint> argument is 0. This option is useful for a couple of reasons: i) comparison between sendto(2) and TX_RING performance, ii) low-traffic packet probing for a given interval, iii) ping-like debugging with specific payload patterns. Furthermore, the TX_RING interface does not cope with interpacket gaps.-S <size>, --ring-size <size>
Manually define the TX_RING resp. TX_RING size in ''<num>KiB/MiB/GiB''. On default the size is being determined based on the network connectivity rate.-k <uint>, --kernel-pull <uint>
Manually define the interval in micro-seconds where the kernel should be triggered to batch process the ring buffer frames. By default, it is every 10us, but it can manually be prolonged, for instance..-E <uint>, --seed <uint>
Manually set the seed for pseudo random number generator (PRNG) in trafgen. By default, a random seed from /dev/urandom is used to feed glibc's PRNG. If that fails, it falls back to the unix timestamp. It can be useful to set the seed manually in order to be able to reproduce a trafgen session, e.g. after fuzz testing.-u <uid>, --user <uid> resp. -g <gid>, --group <gid>
After ring setup, drop privileges to a non-root user/group combination.-V, --verbose
Let trafgen be more talkative and let it print the parsed configuration and some ring buffer statistics.-e, --example
Show a built-in packet configuration example. This might be a good starting point for an initial packet configuration scenario.-C, --no-cpu-stats
Do not print CPU time statistics on exit.-v, --version
Show version information and exit.-h, --help
Show user help and exit.SYNTAX
trafgen's packet configuration syntax is fairly simple. The very basic things one needs to know is that a configuration file is a simple plain text file where packets are defined. It can contain one or more packets. Packets are enclosed by opening '{' and closing '}' braces, for example:
When trafgen is started using multiple CPUs (default), then each of those packets
will be scheduled for transmission on all CPUs by default. However, it is possible
to tell trafgen to schedule a packet only on a particular CPU:
Thus, in case we have a 4 core machine with CPU0-CPU3, packet 1 will be scheduled
only on CPU1, packet 2 on CPU2 and CPU3. When using trafgen with --num option,
then these constraints will still be valid and the packet is fairly distributed
among those CPUs.
Packet content is delimited either by a comma or whitespace, or both:
Packet content can be of the following:
Thus, a quite useless packet packet configuration might look like this (one can
verify this when running this with trafgen in combination with -V):
There are a couple of helper functions in trafgen's language to make life easier
to write configurations:
i) Fill with garbage functions:
ii) Checksum helper functions (packet offsets start with 0):
iii) Multibyte functions, compile-time expression evaluation:
Furthermore, there are two types of comments in trafgen configuration files:
Next to all of this, a configuration can be passed through the C preprocessor
before the trafgen compiler gets to see it with option --cpp. To give you a
taste of a more advanced example, run ''trafgen -e'', fields are commented:
{
{
cpu(1):
cpu(2-3):
{
hex bytes:
decimal:
binary:
octal:
character:
string:
shellcode:
{
byte fill function:
compile-time random:
runtime random numbers:
compile-time counter:
runtime counter
IP/ICMP checksum:
UDP checksum:
TCP checksum:
const8(<content>), c8(<content>), const16(<content>), c16(<content>),
const32(<content>), c32(<content>), const64(<content>), c64(<content>)
These functions write their result in network byte order into the packet
configuration, e.g. const16(0xaa) will result in ''00 aa''. Within c*()
functions, it is possible to do some arithmetics: -,+,*,/,%,&,|,<<,>>,^
E.g. const16((((1<<8)+0x32)|0b110)*2) will be evaluated to ''02 6c''.
/*
#include
{