Skip site navigation (1)Skip section navigation (2)

FreeBSD Man Pages

Man Page or Keyword Search:
Man Architecture
Apropos Keyword Search (all sections) Output format
home | help
ipftest(1)              FreeBSD General Commands Manual             ipftest(1)

NAME
       ipftest - test packet filter rules with arbitrary input.

SYNOPSIS
       ipftest [ -vbdPRSTEHX ] [ -I interface ] -r <filename> [ -i <filename>
       ] [ -s <ipaddress> ]

DESCRIPTION
       ipftest is provided for the purpose of being able to test a set of
       filter rules without having to put them in place, in operation and
       proceed to test their effectiveness.  The hope is that this minimises
       disruptions in providing a secure IP environment.

       ipftest will parse any standard ruleset for use with ipf and apply
       input, returning output as to the result.  However, ipftest will return
       one of three values for packets passed through the filter: pass, block
       or nomatch.  This is intended to give the operator a better idea of
       what is happening with packets passing through their filter ruleset.

       When used without either of -S, -T or -E, ipftest uses its own text
       input format to generate "fake" IP packets.  The format used is as
       follows:
                 "in"|"out" "on" if ["tcp"|"udp"|"icmp"]
                      srchost[,srcport] dsthost[,destport] [FSRPAU]

       This allows for a packet going "in" or "out" of an interface (if) to be
       generated, being one of the three main protocols (optionally), and if
       either TCP or UDP, a port parameter is also expected.  If TCP is
       selected, it is possible to (optionally) supply TCP flags at the end.
       Some examples are:
                 # a UDP packet coming in on le0
                 in on le0 udp 10.1.1.1,2210 10.2.1.5,23
                 # an IP packet coming in on le0 from localhost - hmm :)
                 in on le0 localhost 10.4.12.1
                 # a TCP packet going out of le0 with the SYN flag set.
                 out on le0 tcp 10.4.12.1,2245 10.1.1.1,23 S

OPTIONS
       -v     Verbose mode.  This provides more information about which parts
              of rule matching the input packet passes and fails.

       -d     Turn on filter rule debugging.  Currently, this only shows you
              what caused the rule to not match in the IP header checking
              (addresses/netmasks, etc).

       -b     Cause the output to be a brief summary (one-word) of the result
              of passing the packet through the filter; either "pass", "block"
              or "nomatch".  This is used in the regression testing.

       -I <interface>
              Set the interface name (used in rule matching) to be the name
              supplied.  This is useful with the -P, -S, -T and -E options,
              where it is not otherwise possible to associate a packet with an
              interface.  Normal "text packets" can override this setting.

       -P     The input file specified by -i is a binary file produced using
              libpcap (i.e., tcpdump version 3).  Packets are read from this
              file as being input (for rule purposes).  An interface maybe
              specified using -I.

       -R     Remove rules rather than load them.  This is not a toggle
              option, so once set, it cannot be reset by further use of -R.

       -S     The input file is to be in "snoop" format (see RFC 1761).
              Packets are read from this file and used as input from any
              interface.  This is perhaps the most useful input type,
              currently.

       -T     The input file is to be text output from tcpdump.  The text
              formats which are currently supported are those which result
              from the following tcpdump option combinations:

                 tcpdump -n
                 tcpdump -nq
                 tcpdump -nqt
                 tcpdump -nqtt
                 tcpdump -nqte

       -H     The input file is to be hex digits, representing the binary
              makeup of the packet.  No length correction is made, if an
              incorrect length is put in the IP header.  A packet may be
              broken up over several lines of hex digits, a blank line
              indicating the end of the packet.  It is possible to specify
              both the interface name and direction of the packet (for
              filtering purposes) at the start of the line using this format:
              [direction,interface]  To define a packet going in on le0, we
              would use [in,le0] - the []'s are required and part of the input
              syntax.

       -X     The input file is composed of text descriptions of IP packets.

       -E     The input file is to be text output from etherfind.  The text
              formats which are currently supported are those which result
              from the following etherfind option combinations:

                 etherfind -n
                 etherfind -n -t

       -i <filename>
              Specify the filename from which to take input.  Default is
              stdin.

       -r <filename>
              Specify the filename from which to read filter rules.

       -s <ipaddress>
              Where the input format is incapable of telling ipftest whther a
              packet is going in or out, setting this option to an IP address
              results in the direction being set to out if the source matches
              or in if the destination matches.

SEE ALSO
       ipf(5), ipf(8), snoop(1m), tcpdump(8), etherfind(8c)

BUGS
       Not all of the input formats are sufficiently capable of introducing a
       wide enough variety of packets for them to be all useful in testing.

                                                                    ipftest(1)

NAME | SYNOPSIS | DESCRIPTION | OPTIONS | SEE ALSO | BUGS

Want to link to this manual page? Use this URL:
<https://www.freebsd.org/cgi/man.cgi?query=ipftest&sektion=1&manpath=FreeBSD+5.3-RELEASE>

home | help