blitz / tcptrace Goto Github PK
View Code? Open in Web Editor NEWtcptrace is a tool written by Shawn Ostermann at Ohio University, for analysis of TCP dump files.
Home Page: http://www.tcptrace.org/
License: Other
tcptrace is a tool written by Shawn Ostermann at Ohio University, for analysis of TCP dump files.
Home Page: http://www.tcptrace.org/
License: Other
Fri May 25, 2001 Shawn Ostermann [email protected] tcptrace is a TCP connection analysis tool. It can tell you detailed information about TCP connections by sifting through dump files. The dump file formats supported are: Standard tcpdump format (you need the pcap library) Sun's snoop format Macintosh Etherpeek format HP/NetMetrix protocol analysis format NS simulator output format NetScout NLANR Tsh Format To see the graphs, you'll also need Tim Shepard's xplot program, available at http://www.xplot.org I've switched to using "./configure" to set up the Makefile. That seems to have eased portability problems a great deal. Just say "./configure" and then "make" to build the program. Most of the rest of the Docs are on the web. Check out: http://www.tcptrace.org/ Supported Platforms ------------------- The program is developed here at OU on Sparc machines running Solaris 8. Our intention is that it also run under common Unix variants. In particular, we try to test each release on the following platforms: NetBSD FreeBSD Linux Darwin/OSX (Mac) Tru64 (Alpha) We appreciate feedback and fixes on these or other platforms and will attempt to modify the program to work on other platforms if we can get enough help from people with access to those platforms and the changes are not too "esthetically disagreeable". Running the program ------------------- Some simple examples: 0) What are the args and what do they mean??? tcptrace 1) Run the program quickly over a dump file tcptrace dumpfile 2) Get longer output tcptrace -l dumpfile 3) Generate lots of pretty plot files (you need xplot to see them) tcptrace -G dumpfile 4) Print the segment contents as you go tcptrace -p dumpfile 5) Print progress info (useful for large files) tcptrace -t dumpfile Of course, you can chain arguments together until you get just what you want. Let me know what you think.... Shawn
Hello,
We are currently working on a new fuzz testing feature, and we found a crash in tcptrace.
Step to Reproduce
We configured and built libpcap-1.9.1 using CFLAGS="-g -O0" ./configure
and make
and configured tcptrace using CFLAGS="-L${LIBPCAP_PATH}/lib -I${LIBPCAP_PATH}/include" LDFLAGS="-L${LIBPCAP_PATH}/lib -lpcap" ./configure
and built using make
, and run it with:
./tcptrace -e --nodupack3_data -e -e --showrexmit --nowarn_printtrunc --continuous <attached_file> --tsv -n --nores_addr
Attachment: poc_0007.txt
Environment
Additional context
Here's the stack trace: stack_trace_0007.txt
Program received signal SIGSEGV, Segmentation fault.
0x0000000000425f58 in UpdateConnList (tcp_ptr=0x6fa160, valid=1 '\001', conn_list_head=0x6cc8d8 <live_conn_list_head>, conn_list_tail=0x6cc8e0 <live_conn_list_tail>) at trace.c:1155
1155 ptr_prev->next = ptr_next;
#0 0x0000000000425f58 in UpdateConnList (tcp_ptr=0x6fa160, valid=1 '\001', conn_list_head=0x6cc8d8 <live_conn_list_head>, conn_list_tail=0x6cc8e0 <live_conn_list_tail>) at trace.c:1155
#1 0x0000000000422e22 in UpdateConnLists (tcp_ptr=0x6fa160, ptcp=0x6e7cf4) at trace.c:1083
#2 0x0000000000420bdf in dotrace (pip=0x6e7ce0, ptcp=0x6e7cf4, plast=0x6e7d13) at trace.c:2469
#3 0x0000000000417b7e in ProcessFile (filename=0x7fffffffe220 "input") at tcptrace.c:1167
#4 0x00000000004158ea in main (argc=4, argv=0x7fffffffde58) at tcptrace.c:785
Thank you.
Hello,
We are currently working on a new fuzz testing feature, and we found a crash in tcptrace.
Step to Reproduce
We configured and built libpcap-1.9.1 using CFLAGS="-g -O0" ./configure
and make
and configured tcptrace using CFLAGS="-L${LIBPCAP_PATH}/lib -I${LIBPCAP_PATH}/include" LDFLAGS="-L${LIBPCAP_PATH}/lib -lpcap" ./configure
and built using make
, and run it with:
./tcptrace --showtitle --continuous --nowarn_ooo --limit_conn_num <attached_file> -F -n --nores_addr
Attachment: poc_0006.txt
Environment
Additional context
Here's the stack trace: stack_trace_0006.txt
Program received signal SIGSEGV, Segmentation fault.
0x0000000000426102 in RemoveOldConns (conn_list_head=0x6cc900 <closed_conn_list_head>, conn_list_tail=0x6cc8f8 <closed_conn_list_tail>, expire_interval=480, num_conn_check=1 '\001', conn_count=0x6cc8f4 <closed_conn_count>) at trace.c:1215
1215 if (((*conn_list_head)->ptp->last_time.tv_sec != 0) &&
#0 0x0000000000426102 in RemoveOldConns (conn_list_head=0x6cc900 <closed_conn_list_head>, conn_list_tail=0x6cc8f8 <closed_conn_list_tail>, expire_interval=480, num_conn_check=1 '\001', conn_count=0x6cc8f4 <closed_conn_count>) at trace.c:1215
#1 0x0000000000422f7a in UpdateConnLists (tcp_ptr=0x6fa1c0, ptcp=0x6e7cf4) at trace.c:1101
#2 0x0000000000420bdf in dotrace (pip=0x6e7ce0, ptcp=0x6e7cf4, plast=0x6e7d1b) at trace.c:2469
#3 0x0000000000417b7e in ProcessFile (filename=0x7fffffffe223 "input") at tcptrace.c:1167
#4 0x00000000004158ea in main (argc=4, argv=0x7fffffffde88) at tcptrace.c:785
Thank you.
Hello,
We are currently working on a new fuzz testing feature, and we found a crash in tcptrace.
Step to Reproduce
We configured and built libpcap-1.9.1 using CFLAGS="-g -O0" ./configure
and make
and configured tcptrace using CFLAGS="-L${LIBPCAP_PATH}/lib -I${LIBPCAP_PATH}/include" LDFLAGS="-L${LIBPCAP_PATH}/lib -lpcap" ./configure
and built using make
, and run it with:
./tcptrace --showtitle -d -d -d --nowarn_printtrunc --warn_ooo --noshowsacks <attached_file> -n --nores_addr
Attachment: poc_0004.txt
Environment
Additional context
Here's the stack trace: stack_trace_0004.zip
Program received signal SIGSEGV, Segmentation fault.
_IO_vfprintf_internal (s=0x7fffff7ff560, format=0x47c8f3 "Searching cache for host '%s'\n", ap=0x7fffff801c20) at vfprintf.c:1320
1320 vfprintf.c: No such file or directory.
#0 _IO_vfprintf_internal (s=0x7fffff7ff560, format=0x47c8f3 "Searching cache for host '%s'\n", ap=0x7fffff801c20) at vfprintf.c:1320
#1 0x00007ffff76a4700 in buffered_vfprintf (s=s@entry=0x7ffff7a32680 <_IO_2_1_stderr_>, format=format@entry=0x47c8f3 "Searching cache for host '%s'\n", args=args@entry=0x7fffff801c20) at vfprintf.c:2329
#2 0x00007ffff76a17b6 in _IO_vfprintf_internal (s=0x7ffff7a32680 <_IO_2_1_stderr_>, format=0x47c8f3 "Searching cache for host '%s'\n", ap=ap@entry=0x7fffff801c20) at vfprintf.c:1301
#3 0x00007ffff76aaed4 in __fprintf (stream=<optimized out>, format=<optimized out>) at fprintf.c:32
#4 0x0000000000408cfa in HostName (ipaddress=...) at names.c:179
#5 0x00000000004118b8 in ParenHostName (addr=...) at print.c:630
#6 0x0000000000411039 in printipv4 (pip=0x6e7520, plast=0x6e7547) at print.c:208
#7 0x000000000040fd0e in printip_packet (pip=0x6e7520, plast=0x6e7547) at print.c:179
#8 0x000000000040fa61 in printpacket (len=100, tlen=100, phys=0x0, phystype=0, pip=0x6e7520, plast=0x6e7547, tcb=0x0) at print.c:596
#9 0x000000000042655a in findheader (ipproto=17, pip=0x6e7520, pphdr=0x7fffff8020f8, pplast=0x7fffff802100) at ipv6.c:158
#10 0x000000000042685a in getudp (pip=0x6e7520, ppudp=0x7fffff8020f8, pplast=0x7fffff802100) at ipv6.c:321
#11 0x0000000000410811 in printudp_packet (pip=0x6e7520, plast=0x6e7547) at print.c:523
... <more were omitted> ...
Thank you.
Hello,
We are currently working on a new fuzz testing feature, and we found a crash in tcptrace.
Step to Reproduce
We configured and built libpcap-1.9.1 using CFLAGS="-g -O0" ./configure
and make
and configured tcptrace using CFLAGS="-L${LIBPCAP_PATH}/lib -I${LIBPCAP_PATH}/include" LDFLAGS="-L${LIBPCAP_PATH}/lib -lpcap" ./configure
and built using make
, and run it with:
./tcptrace -l -o5 -c --nowarn_printbadmbz -N --continuous -zx <attached file> --nowarn_printtrunc --noshowrexmit -n --nores_addr
Attachment: poc_0005.txt
Environment
Additional context
Here's the stack trace: stack_trace_0005.txt
Program received signal SIGABRT, Aborted.
__GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
51 ../sysdeps/unix/sysv/linux/raise.c: No such file or directory.
#0 __GI_raise (sig=sig@entry=6) at ../sysdeps/unix/sysv/linux/raise.c:51
#1 0x00007ffff76868b1 in __GI_abort () at abort.c:79
#2 0x00007ffff76cf907 in __libc_message (action=action@entry=do_abort, fmt=fmt@entry=0x7ffff77fcdfa "%s\n") at ../sysdeps/posix/libc_fatal.c:181
#3 0x00007ffff76d697a in malloc_printerr (str=str@entry=0x7ffff77fea88 "double free or corruption (fasttop)") at malloc.c:5350
#4 0x00007ffff76de074 in _int_free (have_lock=0, p=0x714000, av=0x7ffff7a31c40 <main_arena>) at malloc.c:4230
#5 __GI___libc_free (mem=0x714010) at malloc.c:3124
#6 0x0000000000425c74 in RemoveTcpPair (tcp_ptr=0x6fa000) at trace.c:1294
#7 0x0000000000425b32 in RemoveConn (tcp_ptr=0x6fa000) at trace.c:1253
#8 0x0000000000426177 in RemoveOldConns (conn_list_head=0x6cc900 <closed_conn_list_head>, conn_list_tail=0x6cc8f8 <closed_conn_list_tail>, expire_interval=480, num_conn_check=0 '\000', conn_count=0x0) at trace.c:1220
#9 0x0000000000422fd7 in UpdateConnLists (tcp_ptr=0x6fa040, ptcp=0x6e7534) at trace.c:1113
#10 0x0000000000420bdf in dotrace (pip=0x6e7520, ptcp=0x6e7534, plast=0x6e754b) at trace.c:2469
#11 0x0000000000417b7e in ProcessFile (filename=0x7fffffffe203 "input") at tcptrace.c:1167
#12 0x00000000004158ea in main (argc=5, argv=0x7fffffffde48) at tcptrace.c:785
Thank you.
Hello,
We are currently working on a new fuzz testing feature, and we found a crash in tcptrace.
Step to Reproduce
We configured and built libpcap-1.9.1 using CFLAGS="-g -O0" ./configure
and make
and configured tcptrace using CFLAGS="-L${LIBPCAP_PATH}/lib -I${LIBPCAP_PATH}/include" LDFLAGS="-L${LIBPCAP_PATH}/lib -lpcap" ./configure
and built using make
, and run it with:
./tcptrace <attached_file>
Attachment: poc_0001.txt
Environment
Additional context
Here's the stack trace: stack_trace_0001.txt
Program received signal SIGSEGV, Segmentation fault.
0x00000000004182e9 in MemCpy (vp1=0x6e7ce0, vp2=0x6e74e0, n=18446744073709354202) at tcptrace.c:2620
2620 *p1++=*p2++;
#0 0x00000000004182e9 in MemCpy (vp1=0x6e7ce0, vp2=0x6e74e0, n=18446744073709354202) at tcptrace.c:2620
#1 0x00000000004150eb in callback (user=0x0, phdr=0x7fffffffd960, buf=0x6e74d0 "") at tcpdump.c:201
#2 0x000000000046c812 in pcap_offline_read (p=0x6e7230, cnt=<optimized out>, callback=<optimized out>, user=<optimized out>) at ./savefile.c:535
#3 0x000000000041465c in pread_tcpdump (ptime=0x6cf7a0 <current_time>, plen=0x7fffffffdce8, ptlen=0x7fffffffdce4, pphys=0x7fffffffdcf8, pphystype=0x7fffffffdd04, ppip=0x7fffffffdd10, pplast=0x7fffffffdcd8) at tcpdump.c:251
#4 0x0000000000417197 in ProcessFile (filename=0x7fffffffe236 "input") at tcptrace.c:966
#5 0x00000000004158ea in main (argc=1, argv=0x7fffffffdf08) at tcptrace.c:785
Thank you.
Hello All,
In reviewing source code in tcptrace 6.6.7, I found a number of
instances in the code where calls to malloc() are not checked for a
return value of NULL, indicating failure. Also, in some cases, calls
to malloc() are followed by calls to memset() but if the address value
sent to memset() is NULL, the program will abort with a segmentation
violation/fault. The patch files below should address/correct
these issues:
In file mod_http.c, there is a call to malloc() which is not checked
for a return value of NULL, indicating failure. The patch file below
addresses this issue:
--- mod_http.c.orig 2015-10-15 09:25:09.753604594 -0700
+++ mod_http.c 2015-10-15 09:27:52.001225432 -0700
@@ -914,6 +914,10 @@
int i = 0;
int j = 0;
char *buf = (char *)malloc(len);
In file 'mod_inbounds.c', there is a call to malloc() which is not
checked for a return value of NULL, indicating failure.
--- mod_inbounds.c.orig 2015-10-15 09:30:23.056423771 -0700
+++ mod_inbounds.c 2015-10-15 09:31:34.386489456 -0700
@@ -285,6 +285,10 @@
return(0); /* don't call me again */
mod_info = (iinfo *)malloc(sizeof(iinfo));
if (NULL == mod_info) {
fprintf(stderr, "mod_inbounds: unable to allocate memory\n");
exit(-1);
}
In file 'mod_realtime.c', there is a call to malloc() which is not
checked for a return value of NULL, indicating failure.
--- mod_realtime.c.orig 2015-10-15 09:33:07.506324508 -0700
+++ mod_realtime.c 2015-10-15 09:34:09.609217466 -0700
@@ -165,6 +165,10 @@
return(0); /* don't call me again */
mod_info = (rtinfo *)malloc(sizeof(rtinfo));
In file 'output.c', there are two calls to malloc() which are not
checked for a return value of NULL, indicating failure. However,
immediately after the calls to malloc(), calls to memset() are made
with the return value from malloc(), but if this value is NULL, the
program will abort with a segmentation violation/fault. The patch file
below addresses/corrects these issues:
--- output.c.orig 2015-10-15 09:35:25.499862777 -0700
+++ output.c 2015-10-15 09:38:15.528472539 -0700
@@ -1084,6 +1084,10 @@
if(csv || tsv) {
/* Initialize the separator buffer */
sp = (char *)malloc(sizeof(char *) * 2);
if (NULL == sp) {
fprintf(stderr, "PrintSVHeader: Unable to allocate memory\n");
exit(-1);
}
if (NULL == sp) {
fprintf(stderr, "PrintSVHeader: Unable to allocate memory\n");
exit(-1);
}
In file 'output.c', there are three calls to malloc() which are not
checked for a return value of NULL, indicating failure. However,
immediately after one of the calls to malloc(), a call to memset() is
made with the return value from malloc(), but if this value is NULL,
the program will abort with a segmentation violation/fault.
The patch file below addresses/corrects these issues:
--- tcptrace.c.orig 2015-10-15 09:39:55.627194572 -0700
+++ tcptrace.c 2015-10-15 09:44:02.207533665 -0700
@@ -741,6 +741,10 @@
* prints a '#' before each header line if --csv/--tsv is requested.
*/
comment = (char *)malloc(sizeof(char *) * 2);
perror("malloc");
exit(1);
/* (very pessimistically) make the argv array */
argv = malloc(sizeof(char *) * ((strlen(buf)/2)+1));
perror("StringToArgv: malloc");
exit(2);
/* skip leading blanks _/
while ((_buf != '\00') && (isspace((int)*buf))) {
@@ -1628,6 +1636,10 @@
int rc_len=strlen(home)+strlen(TCPTRACE_RC_FILE)+2;
rc_path = malloc(rc_len);
if (NULL == rc_path) {
perror("CheckArguments: malloc");
exit(2);
}
snprintf(rc_path,rc_len, "%s/%s", home, TCPTRACE_RC_FILE);
if (debug>1)
FYI, './configure' && 'make' results in a clean configure and build
with the above patch files.
Bill Parker (wp02855 at gmail dot com)
Hello,
We are currently working on a new fuzz testing feature, and we found a crash in tcptrace.
Step to Reproduce
We configured and built libpcap-1.9.1 using CFLAGS="-g -O0" ./configure
and make
and configured tcptrace using CFLAGS="-L${LIBPCAP_PATH}/lib -I${LIBPCAP_PATH}/include" LDFLAGS="-L${LIBPCAP_PATH}/lib -lpcap" ./configure
and built using make
, and run it with:
./tcptrace -y -q --noshowoutorder -G --continuous --limit_conn_num --tsv -o5-9 <attached_file> -zx -n --nores_addr
Attachment: poc_0003.txt
Environment
Additional context
Here's the stack trace: stack_trace_0003.txt
Program received signal SIGSEGV, Segmentation fault.
__memset_avx2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:164
164 ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S: No such file or directory.
#0 __memset_avx2_unaligned_erms () at ../sysdeps/x86_64/multiarch/memset-vec-unaligned-erms.S:164
#1 0x0000000000417e07 in MallocZ (nbytes=48) at tcptrace.c:1250
#2 0x000000000040f2fd in new_line (plotter=22, label=0x485d48 "rwin", color=0x480088 "yellow") at plotter.c:686
#3 0x0000000000425452 in NewTTP (pip=0x6e7520, ptcp=0x6e7534) at trace.c:617
#4 0x000000000042132d in FindTTP (pip=0x6e7520, ptcp=0x6e7534, pdir=0x7fffffffcf48, tcp_ptr=0x7fffffffcf08) at trace.c:968
#5 0x000000000041cab0 in dotrace (pip=0x6e7520, ptcp=0x6e7534, plast=0x6e754b) at trace.c:1410
#6 0x0000000000417b7e in ProcessFile (filename=0x7fffffffe224 "input") at tcptrace.c:1167
#7 0x00000000004158ea in main (argc=4, argv=0x7fffffffde58) at tcptrace.c:785
Thank you.
Hello,
We are currently working on a new fuzz testing feature, and we found a crash in tcptrace.
Step to Reproduce
We configured and built libpcap-1.9.1 using CFLAGS="-g -O0" ./configure
and make
and configured tcptrace using CFLAGS="-L${LIBPCAP_PATH}/lib -I${LIBPCAP_PATH}/include" LDFLAGS="-L${LIBPCAP_PATH}/lib -lpcap" ./configure
and built using make
, and run it with:
./tcptrace --showtitle -d -d -d --nowarn_printtrunc --warn_ooo --noshowsacks <attached_file> -n --nores_addr
Attachment: poc_0002.txt
Environment
Additional context
Here's the stack trace: stack_trace_0002.zip
Program received signal SIGSEGV, Segmentation fault.
_IO_vfprintf_internal (s=0x7fffff7ff540, format=0x47c8f3 "Searching cache for host '%s'\n", ap=0x7fffff801c00) at vfprintf.c:1320
1320 vfprintf.c: No such file or directory.
#0 _IO_vfprintf_internal (s=0x7fffff7ff540, format=0x47c8f3 "Searching cache for host '%s'\n", ap=0x7fffff801c00) at vfprintf.c:1320
#1 0x00007ffff76a4700 in buffered_vfprintf (s=s@entry=0x7ffff7a32680 <_IO_2_1_stderr_>, format=format@entry=0x47c8f3 "Searching cache for host '%s'\n", args=args@entry=0x7fffff801c00) at vfprintf.c:2329
#2 0x00007ffff76a17b6 in _IO_vfprintf_internal (s=0x7ffff7a32680 <_IO_2_1_stderr_>, format=0x47c8f3 "Searching cache for host '%s'\n", ap=ap@entry=0x7fffff801c00) at vfprintf.c:1301
#3 0x00007ffff76aaed4 in __fprintf (stream=<optimized out>, format=<optimized out>) at fprintf.c:32
#4 0x0000000000408cfa in HostName (ipaddress=...) at names.c:179
#5 0x00000000004118b8 in ParenHostName (addr=...) at print.c:630
#6 0x0000000000411039 in printipv4 (pip=0x6e7520, plast=0x6e7547) at print.c:208
#7 0x000000000040fd0e in printip_packet (pip=0x6e7520, plast=0x6e7547) at print.c:179
#8 0x000000000040fa61 in printpacket (len=100, tlen=100, phys=0x0, phystype=0, pip=0x6e7520, plast=0x6e7547, tcb=0x0) at print.c:596
#9 0x000000000042655a in findheader (ipproto=6, pip=0x6e7520, pphdr=0x7fffff8021b0, pplast=0x7fffff8021c8) at ipv6.c:158
#10 0x000000000042681a in gettcp (pip=0x6e7520, pptcp=0x7fffff8021b0, pplast=0x7fffff8021c8) at ipv6.c:306
#11 0x000000000040fd79 in printtcp_packet (pip=0x6e7520, plast=0x6e7547, thisdir=0x0) at print.c:362
... <more were omitted> ...
Thank you.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.