Riverbed AirPcap software AirPcapReplay

Transcription

1 Riverbed AirPcap software AirPcapReplay 1. Introduction The purpose of this application is to replay network traffic, whether it is contained in a trace file or simply a single packet. In addition to the replay feature, AirPcapReplay also allows the user to edit individual packets using a built-in hex editor. 2. Replaying a Trace File When starting the program the contents of the File Transmit tab are displayed. This tab contains the interface for replaying an entire trace file. With the list in the Adapter section you can select an adapter that is currently present on the system. If only one adapter is plugged in it is chosen by default. When an adapter is chosen, the program shows some details like the supported rates (a, b, g, or n), the ability to transmit and the specific model of AirPcap adapter in use. Once an adapter is selected it's possible to choose a file that is to be replayed by clicking on the Browse button. If no adapter is present the application waits for the user to insert one. Adapters that don t support transmission are listed, but if selected, the user interface will be disabled until an adapter that supports transmission is selected. 1

2 When selecting a trace file, the only file extensions that are accepted are pcap and cap. The application can manage three categories of trace files: simple , Radiotap and PPI. The first kind of file, , contains only packets with no additional header. The second and the third types of trace files contain packets with the Radiotap or PPI header; these headers store additional information such as the channel the packet was received on and its receive rate. Only files containing the FCS field for each packet are allowed. When a file contains no valid packets or lacks an FCS for each packet an error is shown. In the File Name section, just below the trace file path, you can find the link type of the specified file 2

3 and its size. Depending on the kind of file selected, some controls on the graphic interface are enabled. In the above example we have an trace file. As said before, the trace file type does not contain any information about the packets channel or rate, so the Respect Packet Channel and Respect Packet Rate combo boxes are disabled. Three different transmit modes can be selected. By selecting the Respect Capture File Timestamps, the packets stored in the trace file will be sent according to their timestamps. For example, if two packets are separated by three seconds, the first packet is sent immediately and the second will be sent after three seconds have elapsed. The option Maximum Possible Frequency means that there is no delay between packets, so each packet is sent as fast as the adapter can send. The User-defined Packet Period allows the user to specify a packet period in the Transmit Options section. In this case only one packet per specified period, in milliseconds, is sent. The Transmit Options section contains some additional options. The Channel list contains a list of supported channels for the selected adapter. If the selected adapter supports n, it s also possible to choose the extension channel in the list called Channel Extension. Up to 3 possible values are available: 0 (no extension channel), +1 (the extension channel is above the control channel) and -1 (the extension channel is below the control channel). On the right you can choose the rate at which the packet will be transmitted. If the adapter supports n, it s possible to choose between an a/b/g rate (with the list Mb/s ) or an n rate. In the latter case, the rate is expressed in terms of Modulation Coding Scheme (with the list MCS ), use of Short Gap Info or not (with the checkbox Short Gap Info ) and if an extension channel is used, if the packet should be transmitted at 40MHz or 20MHz (with the checkbox 40MHz Channel ). The Packet Period is enabled only if User-defined Packet Period is selected in the Transmit Mode section. 3

4 With the Number of File Transmissions area it's possible to define how many times the trace file will be replayed. With the value 0 the transmission will continue indefinitely or until the Stop button is clicked. Once the configuration is completed, the transmission can be started by clicking on the Transmit button. A progress bar shows the current transmission state. Just above the progress bar the total number of trace file transmissions is displayed. The Stop button can be used to stop the transmission at any moment. In the example shown above, the trace file is scheduled to be sent fifteen times. Notice that during transmission the entire graphic interface is disabled, except the Stop button, to prevent user input. When the transmission ends or is stopped statistics are shown above the progress bar. 4

5 If a Radiotap or PPI trace file is selected the user can choose to respect either the packet s channel by selecting the Respect Packet Channel box or select a particular channel on which the packets are sent. This same choice is offered for the packet s rate using the Respect Packet Rate box. Unselecting one of the check boxes in the Transmit Mode section causes the relative list in the Transmit Options section to become enabled. In the example above the Packet Rate is being respected and therefore it s not possible to manually select a packet rate in the Transmit Options section. Unlike the Respect Packet Rate box, the Respect Packet Channel is unchecked, so the channel on which all the files packets will be sent can be manually selected. 5

6 3. Editing and Sending a Single Packet Selecting the Packet Transmit tab we obtain a dialog box to edit individual packets and send them. Most of the options in this tab are similar to File Transmit tab. A packet can either be created from scratch or loaded from a file. The first control of the Packet Transmit tab is a hexadecimal editor. The hexadecimal editor is comprised of three parts: the byte addresses of the packet on the left; the packet bytes themselves in the middle; and on the right the ASCII equivalents of the packet bytes are displayed. The Adapter section, as in the File Transmit tab allows the user to select the desired adapter from a list. The packet shown in the hexadecimal control can be edited at will, adding bytes or changing those that are already present. Use of the Reset Packet button will restore the packet to its unedited state while the Clear Packet button will unload the current packet. The Load Packet button is used to load a packet from the selected file. When loading a packet from a file only the first packet in the file is used. 6

7 After clicking the Load Packet button the user is asked to select a trace file, and, just like the File Transmit tab, the application accepts pcap and cap extensions. Once the packet has been modified we can save it back to the same trace file, in a new trace file or just transmit it. If we click on the Save Packet button the user is asked if he/she wants to save the packet to a new file. If the user chooses No the first packet of the selected file is overwritten. Otherwise, if Yes is selected the application opens a file dialog to select a new file destination. 7

8 The Transmit Mode section in the Packet Transmit tab is almost the same as its counterpart in the File Transmit tab. The Number of Packets Transmissions area in the Transmit Options section determines the number of times the packet is replayed. With the value of 0 the transmission continues indefinitely or until the Stop button is clicked. The User-defined Packet Period in the Transmit Options allows the user to specify a packet period using the Packet Period area in the Transmit Options section. In this case only one packet per specified period will be sent. 8

9 After setting the options the transmission can be started by clicking on the Transmit button. A progress bar shows the current transmission state and just above it we have which packet is being transmitted. At the transmission end we can read how many packets have been sent. The Stop button can be used to stop the transmission at any moment. In the example above we are transmitting the packet fifteen times. Notice that during transmission the entire graphic interface is disabled, except the Stop button, to prevent user input Riverbed Technology. All rights reserved. 9