Troubleshooting network access problems can be error-prone and tedious. Overlooking rules in long and complex filter rules is too easy and failures caused by routing and NAT do the rest.
lpt simulates an IP packet traversing the Linux kernel and prints out what happens as it progresses through the security features of the kernel and quickly determine wether or not the packet will pass.
lpt was inspired by the Cisco ASA command line utility packet-tracer. It is not about Ciscos network simulator with the same name.
lpt works for IPv4 and IPv6. The corresponding protocol is automatically detected by the IP addresses provided.↑ Top of page ↑
I use GIT repositories, hosted on sourceforge as my version control system of choice - and I recommend you read up on the Git documentation.
The webpage is hosted here and I use sourceforges Ticketsystem to keep track of bugs, etc. There is also a Mailinglist,
currently not used by anyone but me, so I need some more advertisments
for it :-)
(Note: you have to login to sourceforge in order to use the trackers and mailinglists)
If you wish to contribute to development, feel free. To get started, you're probably best off sending me an email, or just checking out repositories and sending me patches via git diff. The Patchtracker is also a good place to put diffs.
lpt has only one dependency: iptables-dev
So simply installing the corresponding packet should suffice.
# cd lpt
↑ Top of page ↑
You can envoke lpt in different ways.
First you can simply execute it without any parameters, in which case all parameters are read from stdin.
Second: You can call it with the following commandline parameters:
lpt src-ifc tcp src-ip src-port dst-ip dst-port lpt src-ifc udp src-ip src-port dst-ip dst-port lpt src-ifc icmp src-ip icmp-type icmp-code [icmp-identifier|dst-ip] lpt src-ifc rawip src-ip proto-id dst-ip
koala #13 ./lpt eth0 tcp 188.8.131.52 23 184.108.40.206 80 lpt - Linux Packet Tracer v0.2 (c) 2013-2015 Oliver Schroeder↑ Top of page ↑
PHASE 1: checking source route ingress interface by route is eth0 RESULT: ACCEPT PHASE 2: checking mangle PREROUTING checking mangle: PREROUTING chain mangle: PREROUTING is empty RESULT: ACCEPT PHASE 3: checking nat PREROUTING checking nat: PREROUTING chain nat: PREROUTING is empty RESULT: ACCEPT PHASE 4: checking destination route egress interface by route is venet0 destination is locallly connected. RESULT: ACCEPT PHASE 5: checking mangle INPUT checking mangle: INPUT chain mangle: INPUT is empty RESULT: ACCEPT PHASE 6: checking filter INPUT checking filter: INPUT matched by rule src: 0.0.0.0/0 dst: 0.0.0.0/0 target: STANDARD ACTION: check target 'STANDARD' => checking filter: STANDARD rule src: 0.0.0.0/0 dst: 220.127.116.11/32 -p tcp tcp dport 80 target: ACCEPT RESULT: ACCEPTED by configured rule PHASE 7: checking mangle OUTPUT checking mangle: OUTPUT chain mangle: OUTPUT is empty RESULT: ACCEPT PHASE 8: checking nat OUTPUT checking nat: OUTPUT chain nat: OUTPUT is empty RESULT: ACCEPT PHASE 9: checking destination reroute PHASE 10: checking filter OUTPUT checking filter: OUTPUT matched by rule src: 0.0.0.0/0 dst: 0.0.0.0/0 target: STANDARD ACTION: check target 'STANDARD' => checking filter: STANDARD rule src: 0.0.0.0/0 dst: 18.104.22.168/32 -p tcp tcp dport 80 target: ACCEPT RESULT: ACCEPTED by configured rule PHASE 11: checking mangle POSTROUTING checking mangle: POSTROUTING chain mangle: POSTROUTING is empty RESULT: ACCEPT PHASE 12: checking nat POSTROUTING checking nat: POSTROUTING chain nat: POSTROUTING is empty RESULT: ACCEPT summary: src ip : 22.214.171.124 via eth0 gateway 126.96.36.199 dst ip : 188.8.131.52 via venet0 locally connected The packet is finally: ACCEPTED completed! koala #14
LPT does not really create an IP packet and track its traces through the kernel. It reads in some basic parameters (source and destination IP address) and gets from the kernel the relevant information in the different stages. E.g. it reads the routing information to see where it would get routed, read in filter rules and parses them one by one etc.↑ Top of page ↑
LPT is currently in ALPHA stadium, meaning that there still some points to work out: