ipftest - test packet filter rules with arbitrary input.
ipftest [ -6bdDNovxX ] [ -F input-format ] [ -I interface ] -r <filename> [
-i <filename> ]
ipftest is provided for the purpose of being able to test a set of filter
rules without having to put them in place, in operation and proceed to test
their effectiveness. The hope is that this minimises disruptions in pro-
viding a secure IP environment.
ipftest will parse any standard ruleset for use with ipf and apply input,
returning output as to the result. However, ipftest will return one of
three values for packets passed through the filter: pass, block or nomatch.
This is intended to give the operator a better idea of what is happening
with packets passing through their filter ruleset.
When used without either of -S, -T or -E, ipftest uses its own text input
format to generate "fake" IP packets. The format used is as follows:
"in"|"out" "on" if ["tcp"|"udp"|"icmp"]
srchost[,srcport] dsthost[,destport] [FSRPAU]
This allows for a packet going "in" or "out" of an interface (if) to be
generated, being one of the three main protocols (optionally), and if
either TCP or UDP, a port parameter is also expected. If TCP is selected,
it is possible to (optionally) supply TCP flags at the end. Some examples
# a UDP packet coming in on le0
in on le0 udp 10.1.1.1,2210 10.2.1.5,23
# an IP packet coming in on le0 from localhost - hmm :)
in on le0 localhost 10.4.12.1
# a TCP packet going out of le0 with the SYN flag set.
out on le0 tcp 10.4.12.1,2245 10.1.1.1,23 S
-v Verbose mode. This provides more information about which parts of
rule matching the input packet passes and fails.
-d Turn on filter rule debugging. Currently, this only shows you what
caused the rule to not match in the IP header checking
-b Cause the output to be a brief summary (one-word) of the result of
passing the packet through the filter; either "pass", "block" or
"nomatch". This is used in the regression testing.
Set the interface name (used in rule matching) to be the name sup-
plied. This is useful with the -P, -S, -T and -E options, where it is
not otherwise possible to associate a packet with an interface. Nor-
mal "text packets" can override this setting.
-F This option is used to select which input format the input file is in.
The following formats are available: etherfind, hex, pcap, snoop,
The input file is to be text output from etherfind. The text for-
mats which are currently supported are those which result from the
following etherfind option combinations:
etherfind -n -t
hex The input file is to be hex digits, representing the binary
makeup of the packet. No length correction is made, if an
incorrect length is put in the IP header. A packet may be broken
up over several lines of hex digits, a blank line indicating the
end of the packet. It is possible to specify both the interface
name and direction of the packet (for filtering purposes) at the
start of the line using this format: [direction,interface] To
define a packet going in on le0, we would use [in,le0] - the 's
are required and part of the input syntax.
pcap The input file specified by -i is a binary file produced using
libpcap (i.e., tcpdump version 3). Packets are read from this
file as being input (for rule purposes). An interface maybe
specified using -I.
The input file is to be in "snoop" format (see RFC 1761). Pack-
ets are read from this file and used as input from any interface.
This is perhaps the most useful input type, currently.
The input file is to be text output from tcpdump. The text for-
mats which are currently supported are those which result from
the following tcpdump option combinations:
-X The input file is composed of text descriptions of IP packets.
Specify the filename from which to take input. Default is stdin.
Specify the filename from which to read filter rules.
ipf(5), ipf(8), snoop(1m), tcpdump(8), etherfind(8c)
Not all of the input formats are sufficiently capable of introducing a wide
enough variety of packets for them to be all useful in testing.