MAUSEZAHN(8) netsniff-ng toolkit MAUSEZAHN(8) (NAME) mausezahn - (Cisco-cli) (SYNOPSIS) mausezahn { [] "<-> | <->" } (DESCRIPTION) mausezahn . trafgen(8) mausezahn mausezahn (CLI) . (DoS) . mausezahn IP (IP multicast) VoIP . . mausezahn : '' '' '' '' . '' '' mausezahn . '' '' (CLI) . ''mops'' ( mausezahn) . Cisco IOS^tm . mausezahn ''-x'' ( 25542 ). telnet(1) mausezahn . mz:mz (enable) mops . /etc/netsniff-ng/mausezahn.conf . : '' '' '' '' ( ''-t'') . '' '' ('' '') : mausezahn eth0 "00:ab:cd:ef:00 00:00:00:00:00:01 08:00 ca:fe:ba:be" ( ) . ''-a'' ''-b'' ''-c'' ''-p'' . . '' '' ''-t '' . ''packet-type'' ''arg-string'' . ''arg-string'' TCP ( ). (OPTIONS) mausezahn . ''help'' . : -x [] mausezahn . telnet mausezahn . 25542 . -6 IPv6 ( IPv4 ). -l IP mausezahn (bind) : 0.0.0.0. -R . SO_PRIORITY . 0..15 Qdisc . 1234:5678 0x12345678 . -v (verbose). -V . -S . . -q . -c count (: 1 : 0). -d . ( ) ( 100m 100msec) ( 100s 100sec) . : mops ( ). -r . -p . (padding) . -a MAC 00:00:aa:bb:cc:dd. MAC . ''rand'' ''own'' MAC ( ) . (broadcast) . -b MAC . (broadcast) (IP) MAC (gateway) . ''bc'' ''bcast'' ''cisco'' ''stp'' . -A IP . ''rand'' IP ''192.168.1.1-192.168.1.100'' ''10.1.0.0/16''. DNS mausezahn IP . -B IP ( 255.255.255.255 ). ( ) DNS . -t . : ''arp'' ''bpdu'' ''ip'' ''udp'' ''tcp'' ''rtp'' ''dns''. ''icmp'' . ''-t help'' mausezahn . ''tcp'' ''mausezahn -t tcp help'' . -T mausezahn . ''rtp'' . mausezahn . ''mausezahn -T rtp help'' . -Q <[CoS:]vlan> [, <[CoS:]vlan>, ...] 802.1Q VLAN (CoS) . VLAN ( QinQ QinQinQinQ.. ). ( "5:10,20,2:30"). VLAN ARP BPDU ( mausezahn ). -M [, ] MPLS MPLS. ( CoS) (TTL) . (BoS) ''S'' () ''s'' ( ) . BoS . . ''-M help'' . -P . ( ''-t udp help'' ). -f ASCII . -F . ASCII "aa:bb:cc:0f:e6...". . (USAGE EXAMPLES) (HOWTO) . mausezahn eth0 -c 0 -d 2s -t bpdu vlan=5 BPDU VLAN 5 PVST+ STP . mausezahn . mausezahn eth0 -c 128000 -a rand -p 64 CAM. mausezahn eth0 -c 0 -Q 5,100 -t tcp flags=syn,dp=1-1023 -p 20 -A rand -B 10.100.100.0/24 SYN VLAN VLAN. VLAN native VLAN . VLAN VLAN 100 native VLAN VLAN 5 . VLAN 100 IP 10.100.100.0/24 1 1023 IP . mausezahn eth0 -c 0 -d 10msec -B 230.1.1.1 -t udp dp=32000,dscp=46 -P Multicast test packet IP 230.1.1.1 UDP 32000 DSCP IP EF (46). 10 . mausezahn eth0 -Q 6:420 -M 100,200,300:5 -A 172.30.0.0/16 -B target.anynetwork.foo -t udp sp=666,dp=1-65535 -p 1000 -c 10 UDP target.anynetwork.foo 172.30.0.0/16 666 MPLS 100 200 300 (300) QoS 5 . VLAN 420 CoS 6 1000 10 . mausezahn -t syslog sev=3 -P Main reactor reached critical temperature. -A 192.168.33.42 -B 10.1.1.9 -c 6 -d 10s syslog (severity) 3 10.1.1.9 IP 192.168.33.42 mausezahn. 10 . mausezahn -t tcp flags=syn|urg|rst, sp=145, dp=145, win=0, s=0-4294967295, ds=1500, urg=666 -a bcast -b bcast -A bcast -B 10.1.1.6 -p 5 TCP MAC . 10.1.1.6 . 145 0 . TCP SYN URG RST TCP 1500 . (urgent pointer) 666 . (CONFIGURATION FILE) mausezahn /etc/netsniff-ng/mausezahn.conf . : /etc/netsniff-ng/mausezahn.conf : option = value : : : user (: mz) password (: mz) enable (: mops) port (: 25542) listen-addr IP CLI (: 0.0.0.0) management-only ( ) cli-device CLI (: all) * * automops automops ( XML ) * * : $ cat /etc/netsniff-ng/mausezahn.conf user = mzadmin password = mzpasswd enable = privilege-mode-passwd port = 65000 listen-addr = 127.0.0.1 (INTERACTIVE MODE HOWTO) Telnet: mausezahn : # mausezahn -x 25542 telnet(1) : # mausezahn -x 99 mausezahn accepts incoming telnet connections on port 99. mz: Problems opening config file. Will use defaults mausezahn : caprica$ telnet galactica 99 Trying 192.168.0.4... Connected to galactica. Escape character is '^]'. mausezahn Username: mz Password: mz mz> enable Password: mops mz# /etc/netsniff-ng/mausezahn.conf ( ) : mausezahn . '?' . . "show packet" "sh pac" "config t" "configure terminal" . . show : mz# show ? mausezahn ARP . ( ): mz# show arp Intf Index IP address MAC address last Ch UCast BCast Info ---------------------------------------------------------------------------------- eth0 [1] D 192.168.0.1 00:09:5b:9a:15:84 23:44:41 1 1 0 0000 Ch MAC (= ). Ucast BCast (unicast) (broadcast) . : mz# show interface Available network interfaces: real real used (fake) used (fake) device IPv4 address MAC address IPv4 address MAC address --------------------------------------------------------------------------------------- > eth0 192.168.0.4 00:30:05:76:2e:8d 192.168.0.4 00:30:05:76:2e:8d lo 127.0.0.1 00:00:00:00:00:00 127.0.0.1 00:00:00:00:00:00 2 interfaces found. Default interface is eth0. : : mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 1 packets defined, 0 active. ( ) ARP mausezahn . config . : : mz# configure terminal mz(config)# packet Allocated new packet PKT0002 at slot 2 mz(config-pkt-2)# ? ... name Assign a unique name description Assign a packet description text bind Select the network interface count Configure the packet count value delay Configure the inter-packet delay interval Configure a greater interval type Specify packet type mac Configure packet's MAC addresses tag Configure tags payload Configure a payload port Configure packet's port numbers end End packet configuration mode ethernet Configure frame's Ethernet, 802.2, 802.3, or SNAP settings ip Configure packet's IP settings udp Configure packet's UDP header parameters tcp Configure packet's TCP header parameters . : mz(config-pkt-2)# name Test mz(config-pkt-2)# description This is just a test mac ip MAC IP : mz(config-pkt-2)# ip address destination 10.1.1.0 /24 mz(config-pkt-2)# ip address source random ( 10.1.1.0 ). IP . VLAN / MPLS : mz(config-pkt-2)# tag ? dot1q Configure 802.1Q (and 802.1P) parameters mpls Configure MPLS label stack mz(config-pkt-2)# tag dot ? Configure 802.1Q tags: VLAN[:CoS] [VLAN[:CoS]] ... The leftmost tag is the outer tag in the frame remove | all Remove one or more tags ( starts with 1), by default the first (=leftmost,outer) tag is removed, keyword 'all' can be used instead of tag numbers. cfi | nocfi [] Set or unset the CFI-bit in any tag (by default assuming the first tag). mz(config-pkt-2)# tag dot 1:7 200:5 : mz(config-pkt-2)# count 1000 mz(config-pkt-2)# delay ? delay [hour | min | sec | msec | usec | nsec] . ( ). mz(config-pkt-2)# delay 1 msec Inter-packet delay set to 0 sec and 1000000 nsec mz(config-pkt-2)# : mausezahn MOPS ( libnet ): mz(config-pkt-2)# type Specify a packet type from the following list: arp bpdu igmp ip lldp tcp udp mz(config-pkt-2)# type tcp mz(config-pkt-2-tcp)# .... seqnr Configure the TCP sequence number acknr Configure the TCP acknowledgement number hlen Configure the TCP header length reserved Configure the TCP reserved field flags Configure a combination of TCP flags at once cwr Set or unset the TCP CWR flag ece Set or unset the TCP ECE flag urg Set or unset the TCP URG flag ack set or unset the TCP ACK flag psh set or unset the TCP PSH flag rst set or unset the TCP RST flag syn set or unset the TCP SYN flag fin set or unset the TCP FIN flag window Configure the TCP window size checksum Configure the TCP checksum urgent-pointer Configure the TCP urgent pointer options Configure TCP options end End TCP configuration mode mz(config-pkt-2-tcp)# flags syn fin rst Current setting is: --------------------RST-SYN-FIN mz(config-pkt-2-tcp)# end mz(config-pkt-2)# payload ascii This is a dummy payload for my first packet mz(config-pkt-2)# end LLDP : mz(config)# packet Allocated new packet PKT0003 at slot 3 mz(config-pkt-3)# type lldp mz(config-pkt-3-lldp)# exit mz(config)# exit LLDP TLV LLDP . CLI : mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config eth0 1000 usec 1000/1000 (0%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/0 (0%) 3 packets defined, 0 active. Layers . 2 ("Test") (E) (I) (T) . 802.1Q (Q) . : mz# start slot 3 Activate [3] mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config eth0 1000 usec 1000/1000 (0%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/1 (0%) 3 packets defined, 1 active. : mz# show packet 2 Packet [2] Test Description: This is just a test State: config, Count=1000, delay=1000 usec (0 s 1000000 nsec), interval= (undefined) Headers: Ethernet: 00-30-05-76-2e-8d => ff-ff-ff-ff-ff-ff [0800 after 802.1Q tag] Auto-delivery is ON (that is, the actual MAC is adapted upon transmission) 802.1Q: 0 tag(s); (VLAN:CoS) IP: SA=192.168.0.4 (not random) (no range) DA=255.255.255.255 (no range) ToS=0x00 proto=17 TTL=255 ID=0 offset=0 flags: -|-|- len=49664(correct) checksum=0x2e8d(correct) TCP: 83 bytes segment size (including TCP header) SP=0 (norange) (not random), DP=0 (norange) (not random) SQNR=3405691582 (start 0, stop 4294967295, delta 0) -- ACKNR=0 (invalid) Flags: ------------------------SYN----, reserved field is 00, urgent pointer= 0 Announced window size= 100 Offset= 0 (times 32 bit; value is valid), checksum= ffff (valid) (No TCP options attached) - 0 bytes defined Payload size: 43 bytes Frame size: 125 bytes 1 ff:ff:ff:ff:ff:ff:00:30 05:76:2e:8d:81:00:e0:01 81:00:a0:c8:08:00:45:00 00:67:00:00:00:00:ff:06 33 fa:e4:c0:a8:00:04:ff:ff ff:ff:00:00:00:00:ca:fe ba:be:00:00:00:00:a0:07 00:64:f7:ab:00:00:02:04 65 05:ac:04:02:08:0a:19:35 90:c3:00:00:00:00:01:03 03:05:54:68:69:73:20:69 73:20:61:20:64:75:6d:6d 97 79:20:70:61:79:6c:6f:61 64:20:66:6f:72:20:6d:79 20:66:69:72:73:74:20:70 61:63:6b:65:74 mz# stop . " " stop all : mz# stop all Stopping [3] PKT0003 Stopped 1 transmission processe(s) launch . STP BPDU : mz# launch bpdu Allocated new packet sysBPDU at slot 5 mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config eth0 1000 usec 1000/1000 (0%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/12 (0%) 4 PKT0004 E---I- IGMP 46 config eth0 100 msec 0/0 (0%) 5 sysBPDU ES---- BPDU 29 active eth0 2 sec 0/1 (0%) 5 packets defined, 1 active. Configuration BPDU ( ). ( ) config ( ). : : mz(config)# packet 2 Modify packet parameters for packet Test [2] mz(config-pkt-2)# interval Configure a greater packet interval in days, hours, minutes, or seconds Arguments: Use a zero value to disable an interval. mz(config-pkt-2)# interval 1 hour mz(config-pkt-2)# count 10 mz(config-pkt-2)# delay 15 usec Inter-packet delay set to 0 sec and 15000 nsec . 'i' 'I' : mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config-i eth0 15 usec 10/10 (0%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/12 (0%) 4 PKT0004 E---I- IGMP 46 config eth0 100 msec 0/0 (0%) 5 sysBPDU ES---- BPDU 29 active eth0 2 sec 0/251 (0%) 5 packets defined, 1 active. mz# start slot 2 Activate [2] mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 Test E-Q-IT 125 config+I eth0 15 usec 10/0 (100%) 3 PKT0003 E----- LLDP 36 config eth0 30 sec 0/12 (0%) 4 PKT0004 E---I- IGMP 46 config eth0 100 msec 0/0 (0%) 5 sysBPDU ES---- BPDU 29 active eth0 2 sec 0/256 (0%) 5 packets defined, 1 active. 'I' . ( ) . 'show packet 2' . : CLI CLI . 'test.mops' : configure terminal packet name IGMP_TEST desc This is only a demonstration how to load a file to mops type igmp load : mz# load test.mops Read commands from test.mops... Allocated new packet PKT0002 at slot 2 mz# show packet Packet layer flags: E=Ethernet, S=SNAP, Q=802.1Q, M=MPLS, I/i=IP/delivery_off, U=UDP, T=TCP PktID PktName Layers Proto Size State Device Delay Count/CntX 1 sysARP_servic... E----- ARP 60 config lo 100 msec 1/0 (100%) 2 IGMP_TEST E---I- IGMP 46 config eth0 100 msec 0/0 (0%) 2 packets defined, 0 active. src/examples/mausezahn/example_lldp.conf LLDP . mausezahn : mz# load /home/hh/tmp/example_lldp.conf . 'show packet' . 'start slot ' . . -- 'configure terminal' . . (DIRECT MODE HOWTO) : . . - . : "aa:bb cc-dd-ee ff 01 02 03-04 05" "aa bb cc dd ee ff:01:02:03:04 05" ( ) : mausezahn ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:ff:08:00:ca:fe:ba:be : mausezahn ff:ff:ff:ff:ff:ff-ff:ff:ff:ff:ff:ff-08:00-ca:fe:ba:be : mausezahn . ( ) : -r . -p ( ). -P (ASCII) . -f (ASCII) . -F . -S : . (-v V) . -t ( ip udp dns ) . : mausezahn -t help mausezahn -t tcp help mausezahn eth3 -t udp sp=69,dp=69,p=ca:fe:ba:be : CLI ( Bash) . . mausezahn eth0 -t udp sp=1,dp=80,p=00:11:22:33 mausezahn eth0 -t udp sp=1,dp=80,p=00:11:22:33 : mausezahn eth0 -t udp "sp=1,dp=80,p=00:11:22:33" -v . (-q) mausezahn ( ). p=... (padding) -p . ! : -t . ARP BPDU CDP IP ICMP UDP TCP RTP DNS SYSLOG . ( VLAN MPLS .) help : mausezahn -t bpdu help mausezahn -t tcp help . payload ( p) ASCII -P : mausezahn eth0 -t ip -P "Hello World" # mausezahn eth0 -t ip p=68:65:6c:6c:6f:20:77:6f:72:6c:64 # mausezahn eth0 -t ip "proto=89, \ p=68:65:6c:6c:6f:20:77:6f:72:6c:64, \ # ttl=1" # IP : ( ). : . -c . count mausezahn . mausezahn ( ;-)). -d . . seconds sec milliseconds msec . ( s m .) : ! : : mausezahn -c 0 "aa bb cc dd ...." 100,000 50 : mausezahn -c 100000 -d 50msec "aa bb cc dd ...." BPDU : mausezahn -c 0 -d 2s -t bpdu conf : mausezahn . 2.5 (2500 msec). : "A" "B" . MAC -a -b . rand own bpdu cisco . IP -A -B . FQDN ( ) 192.168.0.0/24 10.0.0.11-10.0.3.22 . rand ( "" ). : IP ( UDP TCP) mausezahn MAC IP ( ARP DHCP DNS ). ( VLAN MPLS) ARP . : `-- : mausezahn : mausezahn eth0 "ff:ff:ff:ff:ff:ff ff:ff:ff:ff:ff:ff 00:00 ca:fe:ba:be" . : Wi-Fi Wi-Fi . MAC 1000 : mausezahn eth0 -c 0 -a rand -b bcast -p 1000 "08 00 aa bb cc dd" -p . L2 . . . `-- ARP: mausezahn ARP . ARP (request|reply) : sendermac targetmac senderip targetip smac tmac sip tip. ARP MAC IP MAC IP . ARP ( IP ): mausezahn eth0 -t arp ARP: mausezahn eth0 -t arp "reply, senderip=192.168.0.1, targetmac=00:00:0c:01:02:03, \ targetip=172.16.1.50" MAC sendermac senderip IP targetmac targetip . MAC . -a -b . `-- BPDU: mausezahn 802.1D BPDU ( ) . BPDU IEEE 802.1D (rid=bid). 802.3 MAC MAC MAC PVST+ . MAC -b MAC bcast own pvst stp () . PVST+ . VLAN BPDU : mausezahn eth0 -t bpdu "vlan=123, rid=2000" mausezahn -t bpdu help . `-- CDP: mausezahn (CDP) . TLV ( p=00:0e:00:07:01:01:90) CDP mausezahn change CDP : mausezahn -t cdp change -c 0 ;-) mausezahn -t cdp help . `-- 802.1Q VLAN: mausezahn VLAN IP ( ) . -Q <[CoS:]VLAN> -Q 10 -Q 3:921. CoS=0 . TCP VLAN 500 CoS=7: mausezahn eth0 -t tcp -Q 7:500 "dp=80, flags=rst, p=aa:aa:aa" VLAN ! QinQ VLAN : UDP VLAN 100 () 651 (): mausezahn eth0 -t udp "dp=8888, sp=13442" -P "Mausezahn is great" -Q 100,651 : mausezahn eth0 -t udp "dp=8888, sp=13442" -P "Mausezahn is great" \ -Q 6:5,7:732,5:331,5,6 MPLS: mausezahn eth0 -t udp "dp=8888, sp=13442" -P "Mausezahn is great" -Q 100,651 -M 314 VLAN . VLAN 5 CoS 0 81:00 CoS ( PCP) DEI ( CFI) VLAN ( TCI ): mausezahn eth0 -b bc -a rand "81:00 00:05 08:00 aa-aa-aa-aa-aa-aa-aa- aa-aa" `-- MPLS: mausezahn MPLS . -M label . ( CoS) . TTL . TTL 255 . Bottom of Stack ( BoS) S () s ( ) . BoS MPLS . : MPLS 214: mausezahn eth0 -M 214 -t tcp "dp=80" -P "HTTP..." -B myhost.com (214 ): mausezahn eth0 -M 9999,51,214 -t tcp "dp=80" -P "HTTP..." -B myhost.com CoS=5 TTL=1 CoS=7: mausezahn eth0 -M 100:5:1,500:7 -t tcp "dp=80" -P "HTTP..." -B myhost.com BoS ( ): mausezahn eth0 -M 214:s -t tcp "dp=80" -P "HTTP..." -B myhost.com : IP UDP TCP -p . 0x42 (''). DNS ( ). `-- IP: mausezahn IP . IP . IP -A -B . (FQDN) . . IP . : (ASCII): mausezahn eth0 -t ip -A rand -B 192.168.1.0/24 -P "hello world" : mausezahn eth0 -t ip -A 10.1.0.1-10.1.255.254 -B 255.255.255.255 p=ca:fe:ba:be IP : mausezahn eth0 -t ip -B www.xyz.com (ToS) (ECN) ( ) DSCP ( ) (0..63) : DSCP = (EF): mausezahn eth0 -t ip dscp=46,ttl=1,proto=1,p=08:00:5a:a2:de:ad:be:af ( ) . . `-- UDP: mausezahn UDP . ( -B) ( -A) dp ( ) sp ( ) . . : RTP: mausezahn eth0 -B 192.168.1.1 -t udp "dp=16384-32767, \ p=A1:00:CC:00:00:AB:CD:EE:EE:DD:DD:00" DNS ( ): mausezahn eth0 -t udp dp=53,p=c5-2f-01-00-00-01-00-00-00-00-00-00-03-77-77-\ 77-03-78-79-7a-03-63-6f-6d-00-00-01-00-01" len sum ( ). : len () sum ( ) . UDP ( -t udp) IP iplen ipsum . mausezahn ( IP ). `-- ICMP: mausezahn ICMP : PING ( ) Redirect ( ) Unreachable ( ). ICMP . IP ( proto=1). mausezahn -t icmp help . `-- TCP: mausezahn TCP . UDP ( ) sp dp . "|" . SYN 1.1.1.1 IP : mausezahn eth0 -A rand -B 1.1.1.1 -c 0 -t tcp "dp=1-1023, flags=syn" \ -P "Good morning! This is a SYN Flood Attack. \ We apologize for any inconvenience." SYN . ! TCP ( ) TCP (SQNR) . RST DoS SQNR ( ) : mausezahn eth0 -A legal.host.com -B target.host.com \ -t tcp "sp=80,dp=80,s=1-4294967295" SQNR . 40000 65535 ds : mausezahn eth0 -A legal.host.com -B target.host.com \ -t tcp "sp=80, dp=80, s=1-4294967295, ds=40000" mausezahn 4294967295 107375 ( !). TCP . mausezahn IP IP ( ) . `-- DNS: mausezahn DNS UDP . . . : mausezahn eth0 -B mydns-server.com -t dns "q=www.ibm.com" : mausezahn eth0 -A spoofed.dns-server.com -B target.host.com \ "q=www.topsecret.com, a=172.16.1.1" (-t dns help) : query|q = [:] ............. where type is per default "A" (and class is always "IN") answer|a = [::] ...... ttl is per default 0. = [::]/[::]/... : 'query' . 'answer' . : q = www.xyz.com q = www.xyz.com, a=192.168.1.10 q = www.xyz.com, a=A:3600:192.168.1.10 q = www.xyz.com, a=CNAME:3600:abc.com/A:3600:192.168.1.10 mausezahn -t dns help . `-- RTP VoIP: mausezahn (RTP) . G.711 . mausezahn . RFC 3550 "" ( RFC ). Host1 : mausezahn -t rtp -B 192.168.1.19 Host2 (192.168.1.19) : mausezahn -T rtp "T" RTP RTP mausezahn . . : Host1# mausezahn -t rtp id=11:11:11:11 -B 192.168.2.2 & Host1# mausezahn -T rtp id=22:22:22:22 "log, path=/tmp/mz/" Host2# mausezahn -t rtp id=22:22:22:22 -B 192.168.1.1 & Host2# mausezahn -T rtp id=11:11:11:11 "log, path=/tmp/mz/" : 0.00 0.19 0.38 0.57 |-------------------------|-------------------------|-------------------------| ######### 0.07 msec #################### 0.14 msec ## 0.02 msec ### 0.02 msec ######### 0.07 msec #### 0.03 msec ######### 0.07 msec ############# 0.10 msec ## 0.02 msec ########################################### 0.31 msec ######### 0.07 msec ############################################## 0.33 msec ############### 0.11 msec ########## 0.07 msec ############### 0.11 msec ########################################################## 0.42 msec ##### 0.04 msec txt : mausezahn -T rtp txt Got 100 packets from host 192.168.0.3: 0 lost (0 absolute lost), 1 out of order Jitter_RFC (low pass filtered) = 30 usec Samples jitter (min/avg/max) = 1/186/2527 usec Delta-RX (min/avg/max) = 2010/20167/24805 usec Got 100 packets from host 192.168.0.3: 0 lost (0 absolute lost), 1 out of order Jitter_RFC (low pass filtered) = 17 usec Samples jitter (min/avg/max) = 1/53/192 usec Delta-RX (min/avg/max) = 20001/20376/20574 usec Got 100 packets from host 192.168.0.3: 0 lost (0 absolute lost), 1 out of order Jitter_RFC (low pass filtered) = 120 usec Samples jitter (min/avg/max) = 0/91/1683 usec Delta-RX (min/avg/max) = 18673/20378/24822 usec mausezahn -t rtp help mz -T rtp help . `-- (Syslog): Syslog . Syslog ( ): mausezahn -t syslog sev=3 -P "You have been mausezahned." -A 10.1.1.109 -B 192.168.7.7 mausezahn -t syslog help . (NOTE) . TCP . . , . mausezahn LAN . mausezahn SYN DNS ARP . . mausezahn '' . . netsniff-ng(8) . (LEGAL) mausezahn . (GNU GPL) . (HISTORY) mausezahn Herbert Haas . [1] . netsniff-ng . Tobias Klauser Daniel Borkmann . [1] http://www.perihel.at (SEE ALSO) netsniff-ng(8), trafgen(8), ifpps(8), bpfc(8), flowtop(8), astraceroute(8), curvetun(8) (AUTHOR) Herbert Haas Daniel Borkmann . (COLOPHON) netsniff-ng . http://netsniff- ng.org . Linux 03 March 2013 MAUSEZAHN(8)