Skip to content
Yohei Kuga edited this page Aug 14, 2013 · 13 revisions

WikiExamples

Packet capture

$ cat /dev/ethpipe/0 > ./pkt

Packet generate

$ cat ./pkt > /dev/ethpipe/1

Decapsulation Ethernet header and store IP packets

$ cut -b32- /dev/ethpipe

or

$ cut -d' ' -f4- /dev/ethpipe/0 > packets.dump

dhclient and tcpdump

# tappipe pipe0 </dev/ethpipe/0 >/dev/ethpipe/0 &
# ip addr pipe0 # check MAC address
# dhclient –r pipe0 && dhclient pipe0
# tcpdump -i pipe0

tappipe.c

save raw packets to PcapNG file with nanosecond timestamp

$ ethdump < /dev/ethpipe/r0 > dump.pcapng

ethdump.c

Filtering destination MAC address

$ awk '$1=="001122334455"{print $0}' < /dev/ethpipe/0 > /dev/ethpipe/1

VLAN tagging

$ sed -e 's/^\([^ ]* \)\{2\}/&8100 00 01 /' < /dev/ethpipe/0 > /dev/ethpipe/1

VLAN untagging

$ sed -e 's/8100 00 01 //' < /dev/ethpipe/0 > /dev/ethpipe/1

VLAN translation

$ sed -e 's/8100 00 02 /8100 00 01 /' < /dev/ethpipe/0 > /dev/ethpipe/1

Port mirroring

$ cat /dev/ethpipe/0 | tee /dev/ethpipe/1 > /dev/ethpipe/2

Forwarding

$ echo `arp -an | grep "eth1" | cut -f4 -d" "` | sed -e 's/://g' -e 's/\ /\\\|/g' > eth1.txt; \
grep -i `cat eth1.txt` < /dev/ethpipe/0 > /dev/ethpipe/1

L2 over TCP tunneling

[192.168.0.1] $ nc -l 9999 < /dev/ethpipe/0 > /dev/ethpipe/0
[10.0.0.1] $ nc 192.168.0.1 9999 < /dev/ethpipe/0 > /dev/ethpipe/0

ssh tunneling

$ cat /dev/ethpipe/r0 | ssh sample.com "cat > /dev/ethpipe/r0"

Clone this wiki locally