-
Notifications
You must be signed in to change notification settings - Fork 273
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
version of tcpreplay-edit with innermost ip randomization #854
version of tcpreplay-edit with innermost ip randomization #854
Conversation
Moving to staging branch to resolve conflicts, test and review for possibility of pushing into 4.5.0. |
…opic/jasonlue/modify-inner-most-ip-frame
2512ffc
into
appneta:Feature_#854_innermost_ip_randomization_staging
I merged into a staging branch after resolving merge conflicts. I ran tests, and they didn't go well. I inspected the differences and it appears that there are some fundamental errors. For example the portmap test should convert packet 13 from port 80 to 8080. That isn't happening. I also am concerned that many tests for packet overruns are not implemented. This will almost certain result in a flood of CVE's. Finally, I would like to see the "todo" addressed. I really like this feature, but am concerned about targeting for 4.5.0. I will target for the following feature release.
|
tcpreplay-edit is a great tool to replay traffic from a simple seed pcap file, especially with --unique-ip feature. This works great with simply structured pcaps. By simple I mean each packet is NOT encapsulated with layers such as vlan,mpls, vxlan, etc. In reality, especially in data center, encapsulations abound.
Current version of tcpreplay-edit makes effort to handle these encapsulations. It handles vlan (including QinQ, 802.1q, 802.1ad) and mpls (with additional support on EoMPLS). However, this is just the tip of the iceberg. The typical vxlan, for example, is not supported.
Improper handling of the stripping of encapsulation results in parse_metadata() function results in
l2offset: the first appeared ethernet header
vlan_offset: the first appeared vlan header.
l2len stops at the first ip header.
When --unique-ip is applied, it's actually applied on the outermost IP header, which is the first encapsulation layer when the packet is encapsulated in another protocol such as vxlan. This makes --unique-ip almost useless for performance/loadbalance tests.
This MR makes an effort to handle most encapsulation protocols. It also creates a recursive programming structure to extend to more protocols easily.
With the new parse_metadata() function,
l2offset: the last appeared ethernet header
vlan_offset: the first appeared vlan header after the last appeared ethernet header.
l2len stops at the last ip header.
The protocols it covers are below:
Over Ethernet:
vlan: 802.1q, 802.1ad, QinQ
mpls: multiple labels.
PPPoE
Over IPv4/IPv6:
GRE over IP
GRE over IPv6
MPLS over IP
MPLS over IPv6
IPinIP
IP6 in IP6
IP4 in IP6
IP6 in IP4
over MPLS:
EoMPLS: wrap the whole ethernet frame inside MPLS
overPPP
MPLS over PPP
IPv4 over PPP
IPv6 over PPP
over GRE
EoGRE
ERSPAN I
ERSPAN II
ERSPAN III
PPPoGRE
over UDP
VXLAN over UDP
GENEVE over UDP
MPLS over UDP