// Run program as
// anettest -d eth1 -d eth2 -d eth3 -f FASTTEST PARAMETERS: no parameters
Enables FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

regime for packet filter test. See "samples/FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

.fws
// after # user number of interface is specified

/*
FASTTEST PARAMETERS: no parameters
Enables FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

regime is used for implementing fast test of packet filter.
Packets in sequence must be different. They will be registered at first, then generated at one moment.
While generation sniffers will work and registrate recieved packets.
Generation is performed from the first interface specified by -d option (main interface).
Requests after SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST PARAMETERS: no parameters
Enables FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

command correspond to next opened interfaces (EXCEPT MAIN INTERFACE).
Using EXTENDED PARAMETERS: no parameters
Enables EXTENDED PARAMETERS: no parameters
Enables EXTENDED PARAMETERS: no parameters
Enables extended regime. Generating interface can be change by MI PARAMETERS: <name of interface>
Sets the main interface at which packets will be generated or waited (by default it's the first opened interface). The unique name of interface must be specified which may be defined while opening (-d option or OPEN PARAMETERS: <interface's type> <interface's name>
Opens interface of given type. Types: eth, ip, tcp, udp. For tcp this command will wait till connection with server is established or a client connection is accepted. For other types the command won't wait. See more in -d,-p,-T options.

command) after symbol # (e.g. "-d eth0#0"). If no unique name is specified then it will be assigned to number 0,1,2,3,... Default requests are being overwritten: a single ACCEPT request is set for the new main interface, others are ANY. This means that further WAIT command (its analogs) will wait packet ONLY at the new main interface. In order to wait a packet at several interfaces use command DEFAULTS after command MI or explicitly specify requests after WAIT command.

command. While specifying the requests for packet each request must be followed by the unique name of interface.

regime. Generating interface can be change by MI PARAMETERS: <name of interface>
Sets the main interface at which packets will be generated or waited (by default it's the first opened interface). The unique name of interface must be specified which may be defined while opening (-d option or OPEN PARAMETERS: <interface's type> <interface's name>
Opens interface of given type. Types: eth, ip, tcp, udp. For tcp this command will wait till connection with server is established or a client connection is accepted. For other types the command won't wait. See more in -d,-p,-T options.

request is set for the new main interface, others are ANY PARAMETERS: {accept | drop | any }
Request specification. No requests: the packet may be received or not. Analog of SEND ANY. It may be processed as command while testing packet filter only (command FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

or option -c). In common regime it may be amoung parameters to command only. This special word may also be used as value for field that means exclusion the all conditions with this field from current mask of packet - value of the field may be any.

. This means that further WAIT command (its analogs) will wait packet ONLY at the new main interface. In order to wait a packet at several interfaces use command DEFAULTS PARAMETERS: {accept | drop | any | REVERS PARAMETERS: not command
Request specification. May only be given in parameters for DEFAULT command. Instructs to reverse the request for every packet.

}
Defines default requests for packets. These requests will be applied when there are not enough explicitly defined requests for some packet (specified as parameters to command SEND, WAIT and its analogs). Initially default requests are ACCEPT ANY ANY... i.e. a single request for the first interface specified via option -d.

after command MI PARAMETERS: <name of interface>
Sets the main interface at which packets will be generated or waited (by default it's the first opened interface). The unique name of interface must be specified which may be defined while opening (-d option or OPEN PARAMETERS: <interface's type> <interface's name>
Opens interface of given type. Types: eth, ip, tcp, udp. For tcp this command will wait till connection with server is established or a client connection is accepted. For other types the command won't wait. See more in -d,-p,-T options.

or explicitly specify requests after WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

command). If any of them is received then command terminates. Command waits packets until timeout expires (command TIMEOUT PARAMETERS: <interval in milliseconds>
Defines the timeout for WAIT command (and its analogs), also for imitation of application's work. Null value means infinite timeout (such timeout will not be applied for imitation of application's work). In the case of negative value its absolute value will be obtained as timeout, but WAIT command (its analogs) will work differently: it will always wait for the whole timeout (not terminating on first received packet). So several packets may be registered as received. This command also defines the timeout for TCP server while waiting for connections.

). See "samples/waiting_packets.fws".

command.

command. While specifying the requests for packet each request must be followed by the unique name of interface.

command) after symbol # (e.g. "-d eth0#0"). If no unique name is specified then it will be assigned to number 0,1,2,3,... Default requests are being overwritten: a single ACCEPT PARAMETERS: {accept | drop | any }
Request specification. The request that the packet must be received. Analog of SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

ACCEPT PARAMETERS: {accept | drop | any }
Request specification. The request that the packet must be received. Analog of SEND ACCEPT. It may be processed as command while testing packet filter only (command FASTTEST or option -c). In common regime it may be among parameters to command only.

. It may be processed as command while testing packet filter only (command FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

or option -c). In common regime it may be among parameters to command only.

request is set for the new main interface, others are ANY PARAMETERS: {accept | drop | any }
Request specification. No requests: the packet may be received or not. Analog of SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

ANY PARAMETERS: {accept | drop | any }
Request specification. No requests: the packet may be received or not. Analog of SEND ANY. It may be processed as command while testing packet filter only (command FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

. It may be processed as command while testing packet filter only (command FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

. This means that further WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

command (its analogs) will wait packet ONLY at the new main interface. In order to wait a packet at several interfaces use command DEFAULTS PARAMETERS: {accept | drop | any | REVERS PARAMETERS: not command
Request specification. May only be given in parameters for DEFAULT command. Instructs to reverse the request for every packet.

}
Defines default requests for packets. These requests will be applied when there are not enough explicitly defined requests for some packet (specified as parameters to command SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

, WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

and its analogs). Initially default requests are ACCEPT PARAMETERS: {accept | drop | any }
Request specification. The request that the packet must be received. Analog of SEND ACCEPT. It may be processed as command while testing packet filter only (command FASTTEST or option -c). In common regime it may be among parameters to command only.

ANY ANY PARAMETERS: {accept | drop | any }
Request specification. No requests: the packet may be received or not. Analog of SEND ANY. It may be processed as command while testing packet filter only (command FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

... i.e. a single request for the first interface specified via option -d.

}
Defines default requests for packets. These requests will be applied when there are not enough explicitly defined requests for some packet (specified as parameters to command SEND, WAIT and its analogs). Initially default requests are ACCEPT ANY ANY... i.e. a single request for the first interface specified via option -d.

). See "samples/waiting_packets.fws".

command.

or explicitly specify requests after WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in DEFAULTS PARAMETERS: {accept | drop | any | REVERS PARAMETERS: not command
Request specification. May only be given in parameters for DEFAULT command. Instructs to reverse the request for every packet.

}
Defines default requests for packets. These requests will be applied when there are not enough explicitly defined requests for some packet (specified as parameters to command SEND, WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

and its analogs). Initially default requests are ACCEPT ANY ANY... i.e. a single request for the first interface specified via option -d.

(command DEFAULT). For TCP DEVICE PARAMETERS: <type of device> {<name of interface>}
Reopens interfaces. The type of device: eth, ip, tcp. The name of device is the same as for -d option, depends on the type of device. New line terminates the list of names.

the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT PARAMETERS: {accept | drop | any }
Analog of WAIT command. Adds the above packet to the set of packets which will be waited by command WAIT or its analogs. This command does not start actual waiting (doesn't suspend script execution). Nevertheless, just after adding the packet may be registered as received. If some packet is registered as received before the call to WAIT (WAITALL PARAMETERS: no parameters
The analog of WAIT command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD PARAMETERS:
Alias of TOWAIT command.

command (or using of UNFIX command).

) then the command will ignore it and wait for a next packet (see also SENDWAITOTHER PARAMETERS: no parameters
Works similar to "SEND WAITALL" sentence. Purpose: make atomic operation. Without this command there would be a chance that a waited packet did not cause command WAITALL stop waiting if it was accepted after SEND but before WAITALL started waiting. However it would be registered as received in any case. This command should be always used when you need to send a request and RELIABLY receive a response on it never missing.

command.

command). If any of them is received then command terminates. Command waits packets until timeout expires (command TIMEOUT PARAMETERS: <interval in milliseconds>
Defines the timeout for WAIT command (and its analogs), also for imitation of application's work. Null value means infinite timeout (such timeout will not be applied for imitation of application's work). In the case of negative value its absolute value will be obtained as timeout, but WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

command (its analogs) will work differently: it will always wait for the whole timeout (not terminating on first received packet). So several packets may be registered as received. This command also defines the timeout for TCP server while waiting for connections.

). See "samples/waiting_packets.fws".

command.

command. While specifying the requests for packet each request must be followed by the unique name of interface.

regime is also allowed.
*/

FASTTEST PARAMETERS: no parameters
Enables FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

// PAUSE PARAMETERS: <number of milliseconds>
Pauses the execution for a specified interval of time.

100 // if the sniffers start up slowly then you can use additional PAUSE PARAMETERS: <number of milliseconds>
Pauses the execution for a specified interval of time.

INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without include before it.

before it.

tcp

FULLMASK PARAMETERS: no parameters
Fills the mask of packet so that the all fields will be included in mask. So while comparing packets the full packet's content will be compared. By default while describing packet's content the mask will be also added by new conditions, so the using of this command make sense only after the use of RESET PARAMETERS:
Deprecated. Use CLEARMASK PARAMETERS: no parameters
The mask of packet (the set of previously defined conditions) will be cleared. New mask will correspond to any packet. This command is usually contained in headers to make the mask correspond to all packets of given type (ex: TCP packets).

command (this command is used in headers). It must be well realized that packets will be compared only by mask which is not always synchronized with packet's content.

// without with command generated pac3 and pac4 will match with mask for pac2

NAME PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

pac1
srcport 1

SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST PARAMETERS: no parameters
Enables FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

drop accept

NAME PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

pac2
srcport 2

accept drop

NAME PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

pac3
srcip 1.2.1.1

NAME PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

pac4
srcip 1.2.1.2

drop

// PAUSE PARAMETERS: <number of milliseconds>
Pauses the execution for a specified interval of time.

100 // if the way of packet is too long then you can use additional delay

/*
********** REPORT *************
pac1 : accepted (dev 1)
pac4 : accepted (dev 1)
*/