bittwiste

NAME

bittwiste -- pcap capture file editor

SYNOPSIS

bittwiste [ -I input ] [ -O output ] [ -L layer ] [ -X payload ] [ -C ] [ -M linktype ] [ -D offset ] [ -R range ] [ -S timeframe ] [ -T header ] [ header-specific-options ] [ -h ]

DESCRIPTION

This document describes the bittwiste program, the pcap(3) capture file editor. Bittwiste is designed to work only with Ethernet frame, e.g. link type DLT_EN10MB in pcap(3), with a maximum frame size of 1514 bytes which is equivalent to a MTU of 1500 bytes, 14 bytes for Ethernet header. Bittwiste can currently edit Ethernet, ARP, IP, ICMP, TCP, and UDP headers. If run with the -X flag, you can append your own payload after any of these headers; specified using the -L and -T flag. Bittwiste will, if not run with the -C flag, recalculate the checksums for IP, ICMP, TCP, and UDP packets, except for the last fragment of a fragmented IP datagram; bittwiste does not currently support checksum correction for the last fragment of a fragmented IP datagram. While parsing the packets in a trace file, bittwiste will skip, i.e. write to output file as is, any truncated packet, for example, an ICMP packet with a captured length of 25 bytes (we need at least 28 bytes; 14 bytes for Ethernet header, minimum 20 bytes for IP header, and 4 bytes for ICMP header) does not give enough information on its ICMP header for bittwiste to read and modify it. In this case, you can utilize the -L and -T flag to copy the original packet up to its IP header and append your customized ICMP header and data to the packet using the -X flag. When specifying payload that covers the ICMP, TCP or UDP header and its data, you can use zeros, e.g. 0000 for 2 bytes of zeros, for the header checksum which is then corrected automatically by bittwiste. In order to simplify the way options are specified, you can only edit packets of a specific type supplied to the -T flag per execution of bittwiste on a trace file. In addition, the -T flag must appear last among the general options which are the -I, -O, -L, -X, -C, -M, -D, -R and -S flag.

OPTIONS

-I input

Input pcap based trace file.

-O output

Output trace file.

-L layer

Copy up to the specified layer and discard the remaining data. Value for layer must be either 2, 3 or 4 where 2 for Ethernet, 3 for ARP or IP, and 4 for ICMP, TCP or UDP.

-X payload

Append payload in hex digits to the end of each packet.

 

Example: -X 0302aad1

 

-X flag is ignored if -L and -T flag are not specified.

-C

Specify this flag to disable checksum correction. Checksum correction is applicable for non-fragmented IP, ICMP, TCP, and UDP packets only.

-M linktype

Replace the linktype stored in the pcap file header. Typically, value for linktype is 1 for Ethernet.

 

Example: -M 12 (for raw IP), -M 51 (for PPPoE)

For the complete list, see:

 

http://www.tcpdump.org/linktypes.html

-D offset

Delete the specified byte offset from each packet.

 

First byte (starting from link layer header) starts from 1.

 

-L, -X, -C and -T flag are ignored if -D flag is specified.

 

Example: -D 15-40, -D 10 or -D 18-9999

-R range

Save only the specified range of packets.

 

Example: -R 5-21 or -R 9

-S timeframe

Save only the packets within the specified timeframe with up to one-second resolution using DD/MM/YYYY,HH:MM:SS as the format for start and end time in timeframe.

 

Example: -S 22/10/2006,21:47:35-24/10/2006,13:16:05

 

-S flag is evaluated after -R flag.

-T header

Edit only the specified header. Possible keywords for header are, eth, arp, ip, icmp, tcp, or udp. -T flag must appear last among the general options.

-h

Print version information and usage.

header-specific-options

Each packet that matches the type supplied to the -T flag is modified based on the options described below:

Options for eth (RFC 894):

SEE ALSO

bittwist(1), pcap(3), tcpdump(1)

BUGS

File your bug report and send to:

Addy Yeow Chin Heng <[email protected]>

Make sure you are using the latest stable version before submitting your bug report.

COPYRIGHT

Copyright (C) 2006 - 2012 Addy Yeow Chin Heng <[email protected]> This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or any later version. This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details. You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.

AUTHORS

Original author and current maintainer:

Addy Yeow Chin Heng

The current version is available from http://bittwist.sourceforge.net