安装
1 | yum install libpcap libpcap-devel |
配置
tcpburn 按照如下配置intercept 服务可以和tcpburn部署在同一台机器上，另外需要注意的是目标服务与tcpburn、intercept必须在同一个网段。
start.sh1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73killall intercept
killall intercept
rm ./logs/*.log*
sleep 2
intercept server
intercept_server=11.aa.xx.80
intercept_port=36524
our test service
target_server=11.aa.xx.79
target_port=14000
tcpdump_port=14000
generate by tcpdump -s 0 port 80(your port) -i any -w 80.cap
cap_file=client_access_2.0.cap
client_net_range=62.135.250.x
route_net=`echo $client_net_range|awk -F'.' '{print $1"."$2".0.0"}'`
intercept_filter_net=`echo $client_net_range|awk -F'.' '{print $1"."$2"."$3".0"}'`
echo "###################################################################################"
echo "#intercept install on $intercept_server"
echo "#target_server install on $intercept_server ,such as(client_access\setlogic)"
echo "#run this command on $target_server"
echo "# route add -net $route_net netmask 255.255.0.0 gw $intercept_server"
echo "# for delete runing:"
echo "# route del -net $route_net netmask 255.255.0.0 gw $intercept_server"
echo "#use tcpdump to capture packet on realserver,eg:"
echo "# tcpdump -s 0 port $tcpdump_port -i any -w $cap_file"
echo "#"
echo "# use this command to run tcpburn:"
echo "#./tcpburn/objs/tcpburn -x $tcpdump_port-$target_server:$target_port -f $cap_file -s $intercept_server -p $intercept_port -u 100 -c $client_net_range"
echo "###################################################################################"
1. set route on target server
eg:
Assume 65.135.233.161 is the IP address of the assistant server. We set the following
route commands to route all responses to the 62.135.200.x's clients to the assistant
server.
add:
route add -net 62.135.200.0 netmask 255.255.255.0 gw 65.135.233.161
delete:
route -net 62.135.200.0 netmask 255.255.255.0 gw 65.135.233.161
run this on targe sever:such as on execute:
add route to intercept server(11.aa.xx.79)
net 62.135.0.0 must match the client ips at tcpburn option -c here is "62.135.250.x"
route add -net `echo $client_net_range|awk -F'.' '{print $1"."$2".0.0"}' netmask 255.255.0.0 gw $intercept_server
2.start intercept
"src port 80" is match with tcpdump capture
eg:
intercept -i eth1 -F "src port 80 and net 62.135.250.0/24" -b 11.aa.xx.79 -d
intercept -i eth1 -F "src port 80 " -b 11.aa.xx.79 -d
echo intercept -i eth1 -F \"src port $target_port and net $intercept_filter_net/24\" -d
intercept -i eth1 -F "src port $target_port and net $intercept_filter_net/24" -d
intercept -i eth1 -F "src port $target_port and net $intercept_filter_net/24" -d
3. start tcpburn to send request to target server throught intercept
eg:
Assume 65.135.233.160 is the IP address of the target server and 11.aa.xx.79 is the
internal IP address of the assistant server and 65.135.233.161 is the external IP
address of the assistant server.
./tcpburn -x 80-65.135.233.160:80 -f /path/to/80.pcap -s 11.aa.xx.79
-u 10000 -c 62.135.200.x
sleep 5
netstat -anp|grep $intercept_port
file $cap_file is tcpdump: tcpdump -s 0 dst port $tcpdump_port -i any -c 1000000 -w $cap_file
echo ./tcpburn/objs/tcpburn -x $tcpdump_port-$target_server:$target_port -f $cap_file -s $intercept_server -p $intercept_port -u 100 -c $client_net_range
echo "tcpburn log on /usr/local/tcpburn/logs"
./tcpburn/objs/tcpburn -x $tcpdump_port-$target_server:$target_port -f $cap_file -s $intercept_server -p $intercept_port -u 100 -c $client_net_range
