<p>Background</p>
<ul>
<li>It's been about 6 years since I talked about my project ONICS in HPR 1350</li>
<li>ONICS stands for Open Network Inpection Command Suite</li>
<li>I created ONICS as because I thought it would be neat to have a suite of tools that could manipulate packets on the command line in a way similar to how tools lik sed, awk, grep, cut, and so forth manipulate text.</li>
</ul>
<p>Installing</p>
<ul>
<li>Not currently maintained in any package distributions</li>
<li>Maintainers who are interested in doing so are welcome</li>
<li>Install by source</li>
</ul>
<pre><code>    $ git clone https://gitlab.com/catlib/catlib
    $ cd catlib
    $ make
    $ cd ..
    $ git clone https://gitlab.com/onics/onics
    $ cd onics
    $ ./configure
    $ make
    $ make test
    $ sudo make install
    $ make veryclean
</code></pre>
<ul>
<li>Can always uninstall cleanly from the source directory</li>
</ul>
<pre><code>    $ make uninstall
</code></pre>
<ul>
<li>Alternate to installation is to stop at 'make test' and then add to 'onics/bin' and 'onics/scripts' to your path.</li>
</ul>
<p>Documentation</p>
<ul>
<li><p>Manpages are available in onics/doc directory if you aren't installing locally. They are quite extensive.</p></li>
<li><p>If installed locally, starting with:</p></li>
</ul>
<pre><code>    $ man onics
</code></pre>
<p>XPKT Format</p>
<ul>
<li><p>PCAP format is outdated and not very extensible</p>
<ul>
<li>I want to be able to annotate with interface IDs, flow IDs, packet numbers, classification info, header offsets, etc...</li>
</ul></li>
<li><p>First and foremost, the file header prevents just <code>cat</code>ing files together.</p>
<ul>
<li>it makes merging live streams more difficult</li>
<li>pcapng improves things but still has global file header</li>
</ul></li>
</ul>
<p>First Programs</p>
<ul>
<li>Let's first capture in the traditional way</li>
</ul>
<pre><code>    $ sudo tcpdump -i eth0 -c 5 -w file1.pcap
</code></pre>
<ul>
<li>First program is to capture packets from the wire:</li>
</ul>
<pre><code>    $ sudo pktin eth0 &gt; file2.xpkt
</code></pre>
<ul>
<li>If not running as root</li>
</ul>
<pre><code>    $ sudo chown myname file1.pcap file2.xpkt
</code></pre>
<ul>
<li>Let's dump them:</li>
</ul>
<pre><code>    $ tcpdump -r file1.pcap
    $ xpktdump file2.xpkt
</code></pre>
<ul>
<li>Now lets convert the PCAP to XPKT</li>
</ul>
<pre><code>    $ pc2xpkt file1.pcap file1.xpkt
      or
    $ pc2xpkt file1.pcap &gt; file1.xpkt
      or
    $ pc2xpkt &lt; file1.pcap &gt; file1.xpkt
      or
    $ cat file1.pcap | pc2xpkt &gt; file1.xpkt
</code></pre>
<ul>
<li>Now we can dump file1 using xpktdump:</li>
</ul>
<pre><code>    $ xpktdump file1.xpkt
</code></pre>
<p>Something we can't do w/ tcpdump</p>
<ul>
<li>Lets now merge them one after another</li>
</ul>
<pre><code>    $ cat file1.xpkt file2.xpkt &gt; merged.xpkt
    $ xpktdump merged.xpkt
</code></pre>
<ul>
<li>Of course there's a simpler way</li>
</ul>
<pre><code>    $ cat file1.xpkt file2.xpkt | xpktdump
</code></pre>
<p>Convert back to pcap:</p>
<ul>
<li>Let's convert file2 to PCAP</li>
</ul>
<pre><code>    $ xpkt2pc file2.xpkt file2.pcap
      or
    $ xpkt2pc &lt; file2.xpkt &gt; file2.pcap
      or
    $ xpkt2pc file2.xpkt &gt; file2.pcap
      or
    $ cat file2.xpkt | xpkt2pc &gt; file2.pcap
</code></pre>
<ul>
<li>Let's look at the stream using tcpdump:</li>
</ul>
<pre><code>    $ tcpdump -r file2.pcap
</code></pre>
<ul>
<li>If we didn't want to actually store as a PCAP</li>
</ul>
<pre><code>    $ xpkt2pc file2.xpkt | tcpdump -r -
</code></pre>
<ul>
<li>Let's concatenate and dump using tcpdump</li>
</ul>
<pre><code>    $ cat file1.xpkt file2.xpkt | xpkt2pc | tcpdump -r | less
</code></pre>
<p>Sending packets:</p>
<pre><code>    $ sudo tcpdump -i eth0  # in one terminal
    $ sudo pktout -i eth0 file1.xpkt
      or
    $ sudo pktout -i eth0 &lt; file1.xpkt
      or
    $ cat file1.xpkt | sudo pktout -i eth0
</code></pre>
<p>Summary</p>
<ul>
<li>XPKT is a versatile, extensible, self-contained packet trace format</li>
<li>ONICS' most basic tools are pktin, pktout, pc2xpkt and xpkt2pc</li>
<li>We've demonstrated how the ONICS design supports leveraging the power of the UNIX command line for packets</li>
<li>This is only the VERY beginning. ONICS has over 20 binaries and 30 scripts for manipulating packets.</li>
</ul>
