| MZ(1) | General Commands Manual | MZ(1) |
mz - a fast versatile packet generator
mz [options]<arg_string> | <hex_string>
Mausezahn is a free fast traffic generator written in C
which allows you to send nearly every possible and impossible packet.
Mausezahn can also be used for example as didactical tool in network labs or
for security audits including penetration and DoS testing. As traffic
generator Mausezahn is for example used test IP multicast or VoIP networks.
Speeds close to the Ethernet limit are reachable (depending on the hardware
platform, especially the quality of the network interface card).
Mausezahn supports two modes, direct mode and a multi-threaded interactive mode.
The direct mode allows you to create a packet directly on the Linux/UN*X shell and every packet parameter is specified in the argument list when calling Mausezahn.
The interactive mode is an advanced multi-threaded configuration mode with its own command line interface (CLI). This mode allows you to create an arbitrary number of packet types and streams in parallel, each with different parameters. The interactive mode utilizes a completely redesigned and more flexible protocol framework called MOPS (Mausezahn's Own Packet System). The look and feel of the CLI is very similar to the Cisco IOS(tm) command line. You can start the interactive mode by executing Mausezahn with the -x argument (an optional port number may follow, otherwise it is 25542). Then use Telnet to connect to this Mausezahn instance (the default login expects the user 'mz' with password 'mz', and enable password 'mops'; you can change this in /etc/mausezahn/mz.cfg). More information about the interactive mode and MOPS is provided on the Mausezahn website.
The direct mode supports two specification schemes: The
raw-layer-2 scheme, where every single byte to be sent can be
specified, and higher-layer scheme, where packet builder interfaces
are used (using the -t option).
To use the raw-layer-2 scheme, simply specify the desired frame as
hexadecimal sequence (the hex_string), such as
mz eth0 "00:ab:cd:ef:00 00:00:00:00:00:01 08:00 ca:fe:ba:be"
In this example, the spaces within the byte string are optional
and separate the Ethernet fields (destination and source address, type
field, and a short payload). The only additional options supported are
-a, -b, -c, and -p. The frame length MUST be
greater or equal 15 bytes.
The higher-layer scheme is enabled using the -t
<packet_type> option. This option activates a packet builder and
besides the packet_type an optional arg_string can be
specified. The arg_string contains packet-specific parameters, such
as TCP flags, port numbers, etc; see the EXAMPLES below.
Note that Mausezahn requires root privileges. Please see the Mausezahn User's Guide for more details or use Mausezahn's command line help.
Mausezahn provides a built-in context-specific help. Simply append
the keyword help to the configuration options.
The most important options are:
When multiple ranges are specified, e. g. destination port ranges AND destination address ranges, then all possible combinations of ports and addresses are used for packet generation. Furthermore, this can be mixed with other ranges e. g. a TCP sequence number range. Note that combining ranges can lead to a very huge number of frames to be sent. As a rule of thumb you can assume that about 100,000 frames are sent in a fraction of one second, depending on your network interface.
Mausezahn has been designed as fast traffic generator so you can
easily overwhelm a LAN segment with myriads of packets. And because
Mausezahn should also support security audits it is also possible to create
malicious or “invalid” packets, SYN floods, port and address
sweeps, DNS and ARP poisoning, etc.
Therefore, don't use this tool when you are not aware of possible consequences
or have only little knowledge about networks and data communication. If you
abuse Mausezahn for 'unallowed' attacks and get caught, or damage something
of your own, then this is completely your fault. So the safest solution is
to try it out in a lab environment.
Send BPDU frames for VLAN 5 as used with Cisco's PVST+ type of STP. Per default Mausezahn assumes that you want to become the root bridge:
# mz eth0 -c 0 -d 2s -t bpdu vlan=5
Perform a CAM table overflow attack:
# mz eth0 -c 128000 -a rand -p 64
Perform a SYN flood attack to another VLAN using VLAN hopping. This only works if you are connected to the same VLAN which is configured as native VLAN on the trunk. We assume that the victim VLAN is VLAN 100 and the native VLAN is VLAN 5. Lets attack every host in VLAN 100 which use a IP prefix of 10.100.100.0/24, also try out all ports between 1 and 1023 and use a random source IP address:
# mz eth0 -c 0 -Q 5,100 -t tcp "flags=syn,dp=1-1023" -p 20 -A rand -B 10.100.100.0/24
Send IP multicast packets to the multicast group 230.1.1.1 using a UDP header with destination port 32000 and set the IP DSCP field to EF (46). Send one frame every 10 msec:
# mz eth0 -c 0 -d 10msec -B 230.1.1.1 -t udp "dp=32000,dscp=46" -P "Multicast test packet"
Send UDP packets to the destination host target.anynetwork.foo using all possible destination ports and send every packet with all possible source addresses of the range 172.30.0.0/16; additionally use a source port of 666 and three MPLS labels, 100, 200, and 300, the outer (300) with QoS field 5. Send the frame with a VLAN tag 420 and CoS 6; eventually pad with 1000 bytes and repeat the whole thing 10 times:
# mz eth0 -Q 6:420 -M 100,200,300:5 -A 172.30.0.0/16 -B target.anynetwork.foo -t udp "sp=666,dp=1-65535" -p 1000 -c 10
Send six forged Syslog messages with severity 3 to a Syslog server 10.1.1.9; use a forged source IP address 192.168.33.42 and let Mausezahn decide which local interface to use. Use an inter-packet delay of 10 seconds:
# mz -t syslog sev=3 -P "Main reactor reached critical temperature." -A 192.168.33.42 -B 10.1.1.9 -c 6 -d 10s
Send an invalid TCP packet with only a 5 byte payload as layer-2 broadcast and also use the broadcast MAC address as source address. The target should be 10.1.1.6 but use a broadcast source address. The source and destination port shall be 145 and the window size 0. Set the TCP flags SYN, URG, and RST simultaneously and sweep through the whole TCP sequence number space with an increment of 1500. Finally set the urgent pointer to 666, i. e. pointing to nowhere:
# mz -t tcp "flags=syn|urg|rst, sp=145, dp=145, win=0,
s=0-4294967295, ds=1500, urg=666" -a bcast -b bcast -A bcast -B
10.1.1.6 -p 5
Herbert Haas
Visit www.perihel.at/sec/mz/ for Mausezahn news and additional information.
This manual page was written by Herbert Haas <herbert AT perihel DOT at>, for the Debian project.
| March 7, 2010 |