152 lines
5.1 KiB
Plaintext
152 lines
5.1 KiB
Plaintext
|
This is a general list of things which should/could/may be done.
|
||
|
|
If any of these features interest you let me know- especially if you're
|
||
|
|
willing and able to help code it. In general, higher priority tasks are
|
||
|
|
tracked on the tcpreplay website: http://tcpreplay.synfin.net/
|
||
|
|
|
||
|
|
Legend:
|
||
|
|
- = Not started
|
||
|
|
+ = Done
|
||
|
|
O = Mostly done
|
||
|
|
o = Started work
|
||
|
|
. = Canceled
|
||
|
|
? = To think about
|
||
|
|
|
||
|
|
GENERAL:
|
||
|
|
|
||
|
|
+ Improve config file format
|
||
|
|
+ better variable names
|
||
|
|
+ use "var: value" format
|
||
|
|
+ have tcpreplay, tcpprep, tcprewrite sections
|
||
|
|
+ Being solved using GNU AutoOpts
|
||
|
|
|
||
|
|
+ Improve autoconf detection of libraries
|
||
|
|
|
||
|
|
+ Re-organize source tree
|
||
|
|
|
||
|
|
+ tcpdump decoder should print packets syncronously w/ the main process
|
||
|
|
|
||
|
|
+ Better use of GNU Autotools
|
||
|
|
|
||
|
|
+ Improve CLI/config file parsing
|
||
|
|
|
||
|
|
+ Only tcpreplay/tcpbridge should need to run as root.
|
||
|
|
|
||
|
|
+ Tcpreplay should use raw sockets or BPF directly for writing rather then
|
||
|
|
libnet where applicable for theoretically higher performance.
|
||
|
|
|
||
|
|
- Detect system version of libopts b/c we need a recent version
|
||
|
|
|
||
|
|
+ Generalize packet editing and printing code so it can be shipped as a
|
||
|
|
seperate library and plugged into tcpreplay/tcprewrite/flowreplay/etc
|
||
|
|
|
||
|
|
+ See about removing libnet_init() from all binaries other then tcprewrite
|
||
|
|
so we don't have to run as root:
|
||
|
|
. libnet_addr2name4 (ignore, doesn't require libnet_t context)
|
||
|
|
+ libnet_name2addr4
|
||
|
|
+ libnet_get_hwaddr
|
||
|
|
+ libnet_do_checksum
|
||
|
|
|
||
|
|
TCPREPLAY:
|
||
|
|
|
||
|
|
. Add support for dual-nic send on one intf, wait for packet, send next.
|
||
|
|
would be really useful for testing the effectiveness of how well an IPS
|
||
|
|
detects and blocks attacks. (TP's tomahawk does this even better then
|
||
|
|
described here, so why re-invent the wheel?)
|
||
|
|
|
||
|
|
- Rewrite do_sleep() to handle sub sleep times by only nanosleep()'ing
|
||
|
|
once for multiple packets when the timestamps are close enough. We
|
||
|
|
also need to time nanosleep, since different architectures have lower
|
||
|
|
minimum sleep times (Linux/Alpha is 1ms vs. 10ms for Linux/x86)
|
||
|
|
|
||
|
|
+ Tcpreplay should say which interface each packet is going out
|
||
|
|
|
||
|
|
TCPBRIDGE:
|
||
|
|
|
||
|
|
- Duplicate all tcprewrite functionality
|
||
|
|
|
||
|
|
TCPREWRITE:
|
||
|
|
|
||
|
|
- Support fragrouter like features
|
||
|
|
- basic IP fragmenation
|
||
|
|
- TCP fudging
|
||
|
|
- then more advanced stuff
|
||
|
|
- Can we integrate FR's code?
|
||
|
|
|
||
|
|
+ Look at VLAN (802.1q) packets
|
||
|
|
- others non-vanilla types?
|
||
|
|
+ Add tags? Remove tags? Change tags?
|
||
|
|
- Tag only one side of the connection
|
||
|
|
- Support Q-in-Q tags:
|
||
|
|
http://www.informit.com/articles/article.asp?p=101367&rl=1
|
||
|
|
- Cisco's ISL trunking?
|
||
|
|
|
||
|
|
- Add support for MPLS
|
||
|
|
|
||
|
|
- Add support for GRE
|
||
|
|
http://www.linuxguruz.com/iptables/howto/2.4routing-5.html
|
||
|
|
Perhaps this should be done via the hardware interface rather then the GRE
|
||
|
|
virtual interface since libnet doesn't support the GRE virtual
|
||
|
|
|
||
|
|
+ Add support for setting the ethernet protocol field so we can use
|
||
|
|
-I, -K to fill out an entire ethernet header w/o using -2
|
||
|
|
|
||
|
|
+ Add a secondary interface full layer two rewrite option
|
||
|
|
|
||
|
|
+ Fix MAC rewriting to allow sending packets with a MAC of 00:00:00:00:00:00
|
||
|
|
|
||
|
|
- Add support for more linktypes (Prism Monitor, 802.11, FDDI, etc)
|
||
|
|
+ Make it easier for others to add support for others
|
||
|
|
|
||
|
|
+ Rip out packet munger from tcpreplay and put it into another tool so
|
||
|
|
that tcpreplay can be more optimized
|
||
|
|
? perhaps use libnetdude?
|
||
|
|
? make into a library?
|
||
|
|
+ definately put it into a seperate binary (tcprewrite)
|
||
|
|
|
||
|
|
- Add the ability to modify packet data via regex(es) in tcprewrite
|
||
|
|
- Should support pcre
|
||
|
|
- Support (foo) and $1, etc so new data can include old
|
||
|
|
- Limit matching which packets via BPF filter and tcpprep cache
|
||
|
|
(client/server)
|
||
|
|
- Step through packets ala tcpreplay and provide option to edit (Y/n)
|
||
|
|
|
||
|
|
- Support connection tracking and generating 3way handshake for connections
|
||
|
|
missing them.
|
||
|
|
|
||
|
|
- Bump Syn/Ack numbers by a pseudo random or given value so that running
|
||
|
|
the same pcap will behave as different streams.
|
||
|
|
|
||
|
|
- IPv6 support? People ask for this every few months, but nobody actually
|
||
|
|
says they "need" or "really want" it; seems more of "gee, wouldn't it be
|
||
|
|
nice". What does that mean anyways???
|
||
|
|
|
||
|
|
- tcprewrite should be able to remove the two byte ethernet FCS (checksums)
|
||
|
|
at the end of the frame.
|
||
|
|
|
||
|
|
+ Support randomization of IP addresses in ARP packets
|
||
|
|
|
||
|
|
- Add support for rewriting MAC addresses in the ARP body for
|
||
|
|
tcprewrite/tcpbridge to allow proxy-arp like behaviour
|
||
|
|
|
||
|
|
- Add support for IP fragmenting frames which are > MTU
|
||
|
|
|
||
|
|
|
||
|
|
TCPPREP:
|
||
|
|
|
||
|
|
+ When splitting traffic via tcpprep print out each packet (tcpdump style)
|
||
|
|
so end users know where each packet is going
|
||
|
|
|
||
|
|
FLOWREPLAY:
|
||
|
|
|
||
|
|
- Improve flowreplay so it actually works
|
||
|
|
. Use libnids to read the pcaps. This seems DOA at this time since
|
||
|
|
libnids is GPL and the author is unwilling to make it support multiple
|
||
|
|
threads which flowreplay probably needs to be. The only other option is
|
||
|
|
a major rewrite which would break API compatibility. Doesn't seem worth
|
||
|
|
it.
|
||
|
|
- Allow handoff to a socket after user specified client/server exchanges
|
||
|
|
|
||
|
|
- Perhaps integrate stick/snot/fpg logic into flowreplay:
|
||
|
|
http://www.geschke-online.de/FLoP/fpg.8.html
|
||
|
|
to do full 3way handshakes
|