nexp-numspec — Documentation for numeric specifications used in Network Expect PDU definitions
Numbers:
1234
telnet
1234++
1234--
1234+=5
1234-=5
1234*=5
1234/=5
1234%=5
1234<<=5
1234>>=5
1 + 5*(3 + 5)/2
<telnet, www, ssh, 8080>
1..1024
random
random(1..1024)
random(23, 75%)
random(telnet, 75%)
IPv4 Addresses:
192.168.0.1
hostname
hostname.example.com
192.168.0.0/24
hostname/24
hostname.example.com/24
192.168.0.0/255.255.255.0
hostname/255.255.255.0
hostname.example.com/255.255.255.0
192.168.0.1
.. 192.168.0.255
<192.168.0.1, 192.168.0.20,
hostname.example.com>
random
random(192.168.0.0/24)
random(hostname/24)
random(hostname.example.com/24)
When defining packets, Network Expect allows to specify values for most fields in protocol headers using a syntax that gives great flexibility. This syntax, called a Numeric Specification, allows to make the value of a field change with each packet that is created. A numeric specification may specify that the value of a field changes in different ways, like randomly, by incrementing, decrementing, multiplying, or dividing by an arbitrary amount, by choosing a value from a list of values; or it may specify that that the value does not change at all.
If the numeric specification specifies that the value of the field changes then a number of packets will be generated to cover all possible combinations. If the packet definition has several numeric specifications then all numeric specifications will be combined when the packets are created so all combinations are covered.
Currently, Network Expect numeric specifications support regular numbers and IP version 4 addresses.
The rest of this manual page documents the exact syntax that is supported by numeric specifications. Specific examples will be used to make the syntax easier to present.
23: the generated value will always be the same number.
telnet: the generated value will always be 23, the telnet port number. The port number is resolved by calling getservbyname().
23++: the generated value will be 23 initially, and will be incremented by one with each successive packet.
23--: the generated value will be 23 initially, and will be decremented by one with each successive packet.
23+=5: the generated value will be 23 initially, and will be incremented by 5 with each successive packet.
23-=5: the generated value will be 23 initially, and will be decremented by 5 with each successive packet.
23*=5: the generated value will be 23 initially, and will be multiplied by 5 with each successive packet.
23/=5: the generated value will be 23 initially, and will be divided by 5 with each successive packet.
23%=5: the generated value will be 23 initially, and then will be the reminder of a division by 5 (modulus) with each successive packet.
23<<=5: the generated value will be 23 initially, and will bit-shifted 5 bits to the left with each successive packet.
23>>=5: the generated value will be 23 initially, and will bit-shifted 5 bits to the right with each successive packet.
1 + 5*(3 + 5)/2: an expression - the generated value will always be the same, the result of the expression. Valid operators are '+', '-', '*', '/', unary minus ('-'), and the parenthesis ('(' and ')') to force precedence.
<telnet, www, ssh, 8080>: a list of values - the generated values will be 23 (the telnet port), 80 (the HTTP port), 22 (the SSH port), and 8080.
23..25: the generated value will start with 23, will be incremented by one until it reaches 25, and then will go back to 23. This specifies a range of values.
random: the generated value will be a random number in each successive packet.
random(1..1024): the generated value will be a random number between 1 and 1024.
random(23, 75%): the generated value will be 23 twenty-five percent of the time and a random number seventy-five percent of the time.
random(23, 75%): the generated value will be 23 (the telnet port) twenty-five percent of the time and a random number seventy-five percent of the time. The port number is resolved via the getservname() system call.
192.168.0.1: the generated value will always be the IP address 192.168.0.1.
hostname: the generated value will always be the IP address of host hostname.
hostname.example.com: the generated value will always be the IP address of host hostname.example.com.
192.168.0.0/24: the generated value will be the IP address 192.168.0.0 the first time and then will increment by one with each successive packet until 192.168.0.255 is reached.
hostname/24: hostname will be resolved and all IP addresses in the corresponding /24 IP subnetwork will be generated, starting at the bottom of the subnet and incrementing by one with each successive packet until the top of the subnet is reached.
hostname.example.com/24: hostname.example.com will be resolved and all IP addresses in the corresponding /24 IP subnetwork will be generated, starting at the bottom of the subnet and incrementing by one with each successive packet until the top of the subnet is reached.
192.168.0.0/255.255.255.0: the generated value will be the IP address 192.168.0.0 the first time and then will increment by one with each successive packet until all addresses in the 255.255.255.0 subnetwork are covered.
hostname/255.255.255.0: hostname will be resolved and then all IP addresses in the 255.255.255.0 subnetwork will be generated starting at the bottom of the subnetwork and incrementing by one with each successive packet until the highest address in the subnetwork is reached.
hostname.example.com/255.255.255.0: hostname.example.com will be resolved and then all IP addresses in the 255.255.255.0 subnetwork will be generated starting at the bottom of the subnetwork and incrementing by one with each successive packet until the highest address in the subnetwork is reached.
192.168.0.1 .. 192.168.0.255: the generated value will start with 192.168.0.1 and increment by one with each packet until 192.168.0.255 is reached.
192.168.0.1, 192.168.0.20, hostname.example.com: list definition - each packet will use a different IP address from the list.
random: the generated value will be a random IP address with each packet.
random(192.168.0.0/24): the generated value will be a random IP address within the 192.168.0.0/24 subnetwork.
random(hostname/24): hostname will be resolved and then the generated value will be a random IP address within the /24 subnetwork hostname resides in.
random(hostname.example.com/24): hostname.example.com will be resolved and then the generated value will be a random IP address within the /24 subnetwork hostname.example.com resides in.
The following packet definition would generate a single packet since all fields use numeric specifications that result in fixed numbers and IP addresses:
ip(src = 192.168.0.1, dst = 192.168.0.10)/ \ tcp(src = random, dst = 80, window = 16384, \ syn, seq = random, ack-seq = 0)
The following packet definition will generate eight packets because there are two numeric specifications (for IP TTL and destination IP address) that produce two values and one (for TCP destination port) that produces four values.
ip(src = 192.168.0.1, dst = <192.168.0.10, 192.168.0.11>, ttl = <1, 2>)/ \ tcp(src = random, dst = <22..25>, window = 16384, \ syn, seq = random, ack-seq = 0)