/*
   Monitor the status of network objects by sending packets (ICMP-echo, TCP syn or arp request)
   and recieving response packets. A request may be specified for packet.
   If any result doesn't match the request then signal will raise
   and report will be displayed with the list of discrepancies.
 
   run:
       anettest -d eth0 -f this_file.fws
 */

// creating necessary variables

VAR   PARAMETERS: <name of variable> <name of field> <initial value> ("autoset"| ["static"] )
Command creates the new variable <name of variable> or reinitializes the old one if some variable of the same name is already exist. The newly created variable will have the same value's type as <name of field>. This command also sets the <initial value> for variable. Variable's value is stored separately from packet's buffer. The "autoset" type of variable indicates that the variable will be initialized by recieved packet (while using WAIT command or its analogs), i.e. from recieved packet will be obtained value of <name of field> and copied to variable. "static" type indicates that variable must not be changed while recieving packet. The "static" keyword may be ommited only if parameters to command are enclosed in round brackets.
The <name of variable> may appear amoung parameters to other commands. In this case it will be replaced by its value. Such a replacement will be also performed in strings enclosed in apostrophes. In this case the <name of variable> must be enclosed in $ (ex: 'value of variable = $name$').
See "samples/ask_mac.fws", "samples/variables.fws".

 (status, num, 0)
VAR   PARAMETERS: <name of variable> <name of field> <initial value> ("autoset"| ["static"] )
Command creates the new variable <name of variable> or reinitializes the old one if some variable of the same name is already exist. The newly created variable will have the same value's type as <name of field>. This command also sets the <initial value> for variable. Variable's value is stored separately from packet's buffer. The "autoset" type of variable indicates that the variable will be initialized by recieved packet (while using WAIT command or its analogs), i.e. from recieved packet will be obtained value of <name of field> and copied to variable. "static" type indicates that variable must not be changed while recieving packet. The "static" keyword may be ommited only if parameters to command are enclosed in round brackets.
The <name of variable> may appear amoung parameters to other commands. In this case it will be replaced by its value. Such a replacement will be also performed in strings enclosed in apostrophes. In this case the <name of variable> must be enclosed in $ (ex: 'value of variable = $name$').
See "samples/ask_mac.fws", "samples/variables.fws".

 (count, num, 0)

DEFINE   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

 host1, 1.1.1.1
DEFINE   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

 host2, 2.2.2.2

DEFINE   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

 gatewayIP, 10.179.0.1
DEFINE   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

 myip, 10.179.88.9
DEFINE   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

 gatewayMac, 00:1d:a1:73:b3:c0   // defines the address of gateway in local network
DEFINE   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

   PARAMETERS: <name> <value>
Defines the substitution which will be applied while reading some values (in parameters to commands and others). <name> will be replaced by <value>. This substitution may be also performed in strings enclosed in apostrophes. In this case the <name> must be enclosed in $ (ex: 'value = $name$'. See also command GDEF   PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$'.

.

 myMac, 00:1b:38:4f:06:29        // defines the address of this host
                                       // more reasonable to make this definitions in file "base.fws"

QUIET   PARAMETERS: no parameters
Instructs to not display some annoying messages.



TIMEOUT   PARAMETERS: <initval in milliseconds>
Defines the timeout for WAIT command (and its analogs), also for imitation of application's work. Null value means infinite timeout (such timeout will not be applied for imitation of application's work). In the case of negative value its absolute value will be obtained as timeout, but WAIT command (its analogs) will work differently: it will always wait for the whole timeout (not terminating on first recieved packet). So several packets may be registered as recieved. This command also defines the timeout for TCP server while waiting for connections.

   PARAMETERS: <initval in milliseconds>
Defines the timeout for WAIT command (and its analogs), also for imitation of application's work. Null value means infinite timeout (such timeout will not be applied for imitation of application's work). In the case of negative value its absolute value will be obtained as timeout, but WAIT command (its analogs) will work differently: it will always wait for the whole timeout (not terminating on first recieved packet). So several packets may be registered as recieved. This command also defines the timeout for TCP server while waiting for connections.

 = -2000   // timeout of waiting response packets (2 seconds)

DEFAULTS   PARAMETERS: {accept | drop | any | REVERS   PARAMETERS: not command
Request specification. May only be given in parameters for DEFAULT command. Instructs to revers the request for every packet.

 }
Defines default requests for packets. These requests will be applied when there are not enough explicitly defined requests for some packet (specified as parameters to command SEND, WAIT   PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is recieved on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD   PARAMETERS: 
Alias of TOWAIT command.

 command). If any of them is recieved then command terminates. Command waits packets until timeout expires (command TIMEOUT   PARAMETERS: <initval in milliseconds>
Defines the timeout for WAIT command (and its analogs), also for imitation of application's work. Null value means infinite timeout (such timeout will not be applied for imitation of application's work). In the case of negative value its absolute value will be obtained as timeout, but WAIT command (its analogs) will work differently: it will always wait for the whole timeout (not terminating on first recieved packet). So several packets may be registered as recieved. This command also defines the timeout for TCP server while waiting for connections.

). See "samples/waiting_packets.fws".

 and its analogs). Initially default requests are ACCEPT ANY ANY... i.e. a single request for the first interface specified via option -d.

 any   // sets default request - any, i.e. no request by default

// below there is an infinite cycle of sending packets and waiting a response

CYC   PARAMETERS: <number of iterations>
Command instructs that next WAIT command (its analogs) or next block of script will be processed by several times = <number of iterations>. The "inf" value is available which means infinite iterant processing.

 inf {

   // ****************************************************************
   // ****************************************************************
   // ****************************************************************

   // the description of packet which will be waited (ICMP echo response)

   NAME   PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

   PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

 "reply from host1"

   INCLUDE   PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined.

 icmp   //  forms standart ICMP-echo packet

   dstip = myip
   srcip = host1

      OR   PARAMETERS: 
Alias of TOWAIT command.

   PARAMETERS: 
Alias of TOWAIT command.

  // registrates the described packet so the sniffer (in separate thread) starts to wait this packet
          // no request is specified so the default request (any result) will be applied

   // the description of packet to send (ICMP echo request)

   srcmac = myMac
   dstmac = gatewayMac
   // INCLUDE   PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined.

 me2gw

   dstip = host1
   srcip = myip

      SEND   PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST   PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

 and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

   PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST   PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

 and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

  // sends above packet

      WAITALL   PARAMETERS: no parameters
The analog of WAIT command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD   PARAMETERS: 
Alias of TOWAIT command.

 command (or using of UNFIX command).

  // waits registered packets (or terminates immediately if packets have already been recieved)


   // ****************************************************************
   // ****************************************************************
   // ****************************************************************

   // THE NEXT PACKET

   NAME   PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

   PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

 "arp reply from gateway "

   INCLUDE   PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined.

 arp

   srcmac = gatewayMac
   dstmac = myMac

      OR   PARAMETERS: 
Alias of TOWAIT command.

   PARAMETERS: 
Alias of TOWAIT command.

 accept   // accept request is specified - this packet must be accepted

   INCLUDE   PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined.

 arp

   srcmac = myMac
   dstmac = gatewayMac

   arp.type = areq
   arp.srcmac = myMac
   arp.srcip = myip
   arp.dstip = gatewayIP

      SEND   PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST   PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

 and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

   PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST   PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

 and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).


      WAITALL   PARAMETERS: no parameters
The analog of WAIT command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD   PARAMETERS: 
Alias of TOWAIT command.

 command (or using of UNFIX command).



   // ****************************************************************
   // ****************************************************************
   // ****************************************************************

   // THE NEXT PACKET

   NAME   PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

   PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

 "tcp from google   "

   INCLUDE   PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined.

 tcpstdopt

   srcip = www.google.com
   dstip = victim

      OR   PARAMETERS: 
Alias of TOWAIT command.

   PARAMETERS: 
Alias of TOWAIT command.

 drop  // this packet must not be accepted

   INCLUDE   PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined.

 tcpstdopt

   srcport = RAND   PARAMETERS: no command
Specifies the random value for field.



   srcmac = myMac
   dstmac = gatewayMac

   srcip = myip
   dstport = 80
   dstip = www.google.com

      SEND   PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST   PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

 and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

   PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST   PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

 and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).


      WAITALL   PARAMETERS: no parameters
The analog of WAIT command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD   PARAMETERS: 
Alias of TOWAIT command.

 command (or using of UNFIX command).



   // ****************************************************************
   // ****************************************************************
   // ****************************************************************

   SHOWREP   PARAMETERS: no parameters
Displays a report which is the same as that displayed while program termination.

  // displays the report - the list of discrepancies or "SUCCESSFULL TEST"

   IF   PARAMETERS: <value1> <type of compare> <value2> "{" <first block of script> "}" [ "else" "{" <second block of script> "}" ]
Processes the first block of script if condition is met, otherwise processes the second block if it is specified. <Types of compare>: = (==), !=, >, <, >=, <=. Hexadecimals number are treated as strings (with 0x prefix). If you have problems try to watch how these values are represented by string using PRINT command for example.

   PARAMETERS: <value1> <type of compare> <value2> "{" <first block of script> "}" [ "else" "{" <second block of script> "}" ]
Processes the first block of script if condition is met, otherwise processes the second block if it is specified. <Types of compare>: = (==), !=, >, <, >=, <=. Hexadecimals number are treated as strings (with 0x prefix). If you have problems try to watch how these values are represented by string using PRINT command for example.

 LASTRES   PARAMETERS: no command
This special value enables to get the last result of statistic analyzing performed by SHOWREP. 0 - successfull, 2 - some discrepancy is found.

 == 2 {

      // test is not successfull

      status += 1    // increments the status variable
   }
   else {

      // test is successfull

      status = 0     // resets the status variable
   }

   IF   PARAMETERS: <value1> <type of compare> <value2> "{" <first block of script> "}" [ "else" "{" <second block of script> "}" ]
Processes the first block of script if condition is met, otherwise processes the second block if it is specified. <Types of compare>: = (==), !=, >, <, >=, <=. Hexadecimals number are treated as strings (with 0x prefix). If you have problems try to watch how these values are represented by string using PRINT command for example.

   PARAMETERS: <value1> <type of compare> <value2> "{" <first block of script> "}" [ "else" "{" <second block of script> "}" ]
Processes the first block of script if condition is met, otherwise processes the second block if it is specified. <Types of compare>: = (==), !=, >, <, >=, <=. Hexadecimals number are treated as strings (with 0x prefix). If you have problems try to watch how these values are represented by string using PRINT command for example.

 status >= 3 {

      // if status variable is too large

      BEEP   PARAMETERS: no parameters
Plays the sound via PC speaker.

           // plays a sound
      // PLAY   PARAMETERS: <name of wav file>
Windows only. Plays the specified sound, WAV-file. Sound system must be enabled. If the file is not found then default Windows sound will be played. If the file is in current folder or in standard system folder then the full path is not required (Media/<name>). 
Under UNIX the sound will be played by PC speaker.

 "Windows XP Battery Critical.wav"
 // under Windows plays a wav file, if sound system is enabled

      PRINTL   PARAMETERS: <message>
Analog of PRINT command. Additionally performs the line feed.

 status  // displays the value of status variable
   }

   CLEARREG   PARAMETERS: no parameters
Clears the information about all the packets which were added to the waited ones (by WAIT, ADD   PARAMETERS: 
Alias of TOWAIT command.

 commands). They will not be displayed in final report (or in the report that is displayed by SHOWREP   PARAMETERS: no parameters
Displays a report which is the same as that displayed while program termination.

 command). If this command is typed at the end of script then it omits the displaying of final report (sense there are no packet in it).

 // clears info about all registered packets

   // pauses execution

   IF   PARAMETERS: <value1> <type of compare> <value2> "{" <first block of script> "}" [ "else" "{" <second block of script> "}" ]
Processes the first block of script if condition is met, otherwise processes the second block if it is specified. <Types of compare>: = (==), !=, >, <, >=, <=. Hexadecimals number are treated as strings (with 0x prefix). If you have problems try to watch how these values are represented by string using PRINT command for example.

   PARAMETERS: <value1> <type of compare> <value2> "{" <first block of script> "}" [ "else" "{" <second block of script> "}" ]
Processes the first block of script if condition is met, otherwise processes the second block if it is specified. <Types of compare>: = (==), !=, >, <, >=, <=. Hexadecimals number are treated as strings (with 0x prefix). If you have problems try to watch how these values are represented by string using PRINT command for example.

 count > 5 {

      PAUSE   PARAMETERS: <number of milliseconds>
Pauses the execution for a specified interval of time.

 3000
   }
   else {

      PAUSE   PARAMETERS: <number of milliseconds>
Pauses the execution for a specified interval of time.

 500
   }

   count += 1
}