Change multiples IP and MAC with tcprewrite - tcpreplay

I'm working with tcpreplay and I have a question. Let's say I have three hosts on the same network, for example 172.16.25.0/24. While these hosts exchange messages with each other, I capture the data on the interface of one of them through tcpdump, generating a .pcap file. How do I change the IP and MAC addresses of the three hosts using tcprewrite?
Following the changes I want to achieve:
172.16.25.151 (00:00:00:00:00:a1) -> 10.10.10.151 (00:00:00:00:00:51)
172.16.25.152 (00:00:00:00:00:b1) -> 10.10.10.152 (00:00:00:00:00:52)
172.16.25.153 (00:00:00:00:00:c1) -> 10.10.10.153 (00:00:00:00:00:53)
For the cache file:
tcpprep --auto=bridge --pcap=ping.pcap --cachefile=case1.cache
My problem is when I try rewrite the endpoints MAC address.
I used:
tcprewrite --endpoints=172.16.25.151:172.16.25.152 --enet-smac=00:00:00:00:00:a1,00:00:00:00:00:51 --enet-dmac=00:00:00:00:00:b1,00:00:00:00:00:52 -i ping.pcap -o ping.pcap-rw-mac.pcap --cachefile=case1.cache
And this replace all flows with 00:00:00:00:00:51,172.16.25.151->00:00:00:00:00:52,172.16.25.152, inclusive those with the host_153.
What am I doing wrong?

Related

Two Lslidar(Leishen) connected with One Embedded Board(Jetson Xavier)`s possible?

Running one of the Lslidar(16 Channels) on the Embeded board(ROS development environments) is not a problem.
This is because you can use the default IP and ports.
But I plan to run two at the same time, and I want to use values other than the default values of ports and IP..
For example, you can use ports like 2368 and 2369.
I need a reference to refer to how to change the port value and IP value...
Help Plz...
Here is code from lsLidar driver from ROS Wiki:
bool LslidarC16Driver::loadParameters() {
//pnh.param("frame_id", frame_id, std::string("lslidar"));
pnh.param("lidar_ip", lidar_ip_string, std::string("192.168.1.222"));
pnh.param<int>("device_port", UDP_PORT_NUMBER,2368);
pnh.param<bool>("add_multicast", add_multicast, false);
pnh.param("group_ip", group_ip_string, std::string("234.2.3.2"));
inet_aton(lidar_ip_string.c_str(), &lidar_ip);
ROS_INFO_STREAM("Opening UDP socket: address " << lidar_ip_string);
if(add_multicast) ROS_INFO_STREAM("Opening UDP socket: group_address " << group_ip_string);
ROS_INFO_STREAM("Opening UDP socket: port " << UDP_PORT_NUMBER);
return true;
}
As you can see there is a place where you can change port and IP. For two devices I'd advise you to modify the original driver. All source code is available on https://github.com/tongsky723/lslidar_C16
Clone it to you workspace and create additional functionality for two LiDARs.

How to obtain bluetooth port direction with pyserial?

I'm trying to connect to an RN42, module through python. When the RN42 pairs with W10 it creates two virtual COM ports(outgoing and incoming). I need to connect to the outgoing port.
I'm trying to do this automatically. I've tried:
import serial
import serial.tools.list_ports as port_lst
ports = list(port_lst.comports())
bluetooth_ports = []
for p in ports:
if 'Bluetooth' in p.description:
bluetooth_ports += [p.device]
bluetooth_com = serial.Serial(bluetooth_ports[0],115200)
I thought that the first port was usually the outgoing one, but I've paired the module to another computer, and this didn't apply (the second port was the outgoing one). Is there a way to find out the direction of the COM ports?
Thanks!!!
Although this is an antique question, I have been searching for the answer to this for some time myself and since I finally figured it out I wanted others to be able to find the answer. With help from a blog entry at in the hand and its accompanying gist:
The trick is to acquire the hwid using pySerial, then parse the address. The incoming port in a pair has an address of zero and the outgoing port has a nonzero address. Here is some ugly Python code that decodes it:
import serial.tools.list_ports
cp=serial.tools.list_ports.comports()
for p in cp:
if "BTHENUM" in p.hwid:
start_of_address=p.hwid.rfind("&")
end_of_address=p.hwid.rfind("_")
address=p.hwid[start_of_address+1:end_of_address]
if int(address,16)==0:
port_type="incoming"
else:
port_type="outgoing"
print(p.hwid)
print(p.name, address, port_type)
And the output:
BTHENUM\{00001101-0000-1000-8000-00805F9B34FB}_LOCALMFG&0000\7&CC47540&0&000000000000_000000A8
COM4 000000000000 incoming
BTHENUM\{00001101-0000-1000-8000-00805F9B34FB}_LOCALMFG&0002\7&CC47540&0&209BA5420081_C00000000
COM5 209BA5420081 outgoing

Wireshark: Call MAC dissector from .lua plugin

I am trying to call specific protocol dissectors from my .lua plugin.
The line is:
Dissector.get("mac"):call(buf, pinfo, tree)
Some work (e.g. gtp) but others I need do not (e.g. mac for MAC, rsl for RSL). I looked at the epan/dissectors folder and tried other variations to no avail.
Anyone knows if the issue is finding the correct name of the protocol, or something else?
Below is the answer I provided to this same question over at https://ask.wireshark.org/question/6288/call-mac-dissector-from-lua-plugin/, but copied here for convenience:
If you're looking for the correct protocol names, you can try running something like tshark -G protocols | grep NAME … where NAME is the name of the protocol you're looking for. (Refer to the tshark man page for more details on the -G option.)
For example:
$ tshark -G protocols | grep RSL
Radio Signalling Link (RSL) RSL gsm_abis_rsl
So in the case of RSL, it looks like you'd need Dissector.get("gsm_abis_rsl"):call(buf, pinfo,tree)
Of course this doesn't always work, because the same search for MAC does find it:
$ tshark -G protocols | grep MAC
DOCSIS Mac Management DOCSIS MAC MGMT docsis_mgmt
MACsec Key Agreement EAPOL-MKA mka
Radio Link Control, Medium Access Control, 3GPP TS44.060 GSM RLC MAC gsm_rlcmac
ISMACryp Protocol ISMACRYP ismacryp
**MAC MAC mac**
MAC-LTE MAC-LTE mac-lte
mac-lte-framed MAC-LTE-FRAMED mac-lte-framed
MAC-NR MAC-NR mac-nr
MikroTik MAC-Telnet Protocol MAC-Telnet mactelnet
MAC Control MACC macc
802.1AE Security tag MACsec macsec
MPLS-MAC Media Access Control (MAC) Address Withdrawal over Static Pseudowire mpls_mac
WiMax MAC Management Message MGMT MSG wmx.mgmt
DCOM IRemoteActivation REMACT remact
Token-Ring Media Access Control TR MAC trmac
WiMax Generic/Type1/Type2 MAC Header Messages WiMax Generic/Type1/Type2 MAC Header (hdr) wmx.hdr
WiMAX MAC-PHY over Ethernet WiMAX MAC-PHY wimaxmacphy
In this case, it seems you need to look at the source code (unless there's some other method I'm not aware of) in order to find the dissector that's actually registered.
$ grep "proto_register_protocol" packet-*.c | grep "\"MAC\""
packet-umts_mac.c: proto_umts_mac = proto_register_protocol("MAC", "MAC", "mac");
$ grep register_dissector packet-umts_mac.c
register_dissector("mac.fdd.rach", dissect_mac_fdd_rach, proto_umts_mac);
register_dissector("mac.fdd.fach", dissect_mac_fdd_fach, proto_umts_mac);
register_dissector("mac.fdd.pch", dissect_mac_fdd_pch, proto_umts_mac);
register_dissector("mac.fdd.dch", dissect_mac_fdd_dch, proto_umts_mac);
register_dissector("mac.fdd.edch", dissect_mac_fdd_edch, proto_umts_mac);
register_dissector("mac.fdd.edch.type2", dissect_mac_fdd_edch_type2, proto_umts_mac);
register_dissector("mac.fdd.hsdsch", dissect_mac_fdd_hsdsch, proto_umts_mac);

Wireshark display filter: host to host

I need to Write a Wireshark display filter to meet the following requirements.
All traffic from host 192.168.12.44 to host 192.168.12.1
I believe it is just
ip.src_host = 192.168.12.44 && ip.dst_host 192.168.12.1
or
ip.src== 192.168.12.44 && ip.dst==192.168.12.1
I'm just not sure which syntax is correct. Can anyone offer any tips/advice? I tried this on two different IPs that i can actually test yet they seem to offer different results, so I'm not sure which one I need.
ip.src & ip.dst are for IP adresses while ip.src_host & ip.dst_host are for their DNS names. Suppose an IP with the address 192.168.1.1 has a corresponding DNS name of mydns.mysite.com. Assuming you have enabled Resolve Network Address under View --> Name Resolution, then ip.src_host will filter mydns.mysite.com while when not enabled ip.src will filter 192.168.1.1
Please refer to this link for more information.

How to get ip addresses of all units in a service in Juju charm?

I am new to Juju and trying to write a charm. I need ip address of all units deployed in a service. I am using
e.g.I have 3 units of wordpress with--
juju deploy -n 3 cs:wordpress
I deployed my charm from local repo -- juju deploy local:trusty/X
I add relation between the two-- juju add-relation X wordpress
Now, I need list of all 3 ip addresses of wordpress service in one of the hook in my charm(X)
I set relation-keys in wordpress and tried using relation-ids -> relation-list -> relation-get hook tools in my charm.
But it gives me just one ip and not all three.
relation-ids --gives one id.
relation-list id --gives just one unit.
relation-get --gives corresponding ip.
what should I do to get expected result?
Try something like this:
from charmhelpers.contrib.openstack.utils import get_host_ip
from charmhelpers.core.hookenv import (
relation_ids,
related_units,
relation_get,
)
def _get_ips(rel_name):
return [get_host_ip(rdata['private-address'])
for rid in relation_ids(rel_name)
for rdata in
(relation_get(rid=rid, unit=unit) for unit in related_units(rid))
if rdata]
ips = _get_ips("wordpress")
The relation name might be different in your case. Do confirm that.
you can get a unit's address using
get_host_ip(unit_get('private-address')
where get_host_ip can be imported from charmhelpers
from charmhelpers.contrib.openstack.utils import get_host_ip
To get IP addresses of all units of charms, you have to add peer relation. You can read about relations from here

Resources