/*
Traces tcp and udp packets and displays info about them.
run program as
anettest -d eth0 -f this_file.fws
*/

INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without include before it.

before it.

udp
NAME PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

udp_packet
MES PARAMETERS: <string of message>
Defines the message which will be displayed the every time on receiving the currently described packet. Substitutions are allowed in the form of $name$. The 'name' may reference to the field's name, variable's name, someone defined by GDEF PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$').

command. In the case of field's name field's value will be retrieved from the content of received packet.

'udp packet recieved from $srcip$:$srcport$ to $dstip$:$dstport$\n'
OR PARAMETERS:
Alias of TOWAIT PARAMETERS: {accept | drop | any }
Analog of WAIT command. Adds the above packet to the set of packets which will be waited by command WAIT or its analogs. This command does not start actual waiting (doesn't suspend script execution). Nevertheless, just after adding the packet may be registered as received. If some packet is registered as received before the call to WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

command). If any of them is received then command terminates. Command waits packets until timeout expires (command TIMEOUT PARAMETERS: <interval in milliseconds>
Defines the timeout for WAIT command (and its analogs), also for imitation of application's work. Null value means infinite timeout (such timeout will not be applied for imitation of application's work). In the case of negative value its absolute value will be obtained as timeout, but WAIT command (its analogs) will work differently: it will always wait for the whole timeout (not terminating on first received packet). So several packets may be registered as received. This command also defines the timeout for TCP server while waiting for connections.

). See "samples/waiting_packets.fws".

(WAITALL PARAMETERS: no parameters
The analog of WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD PARAMETERS:
Alias of TOWAIT PARAMETERS: {accept | drop | any }
Analog of WAIT command. Adds the above packet to the set of packets which will be waited by command WAIT or its analogs. This command does not start actual waiting (doesn't suspend script execution). Nevertheless, just after adding the packet may be registered as received. If some packet is registered as received before the call to WAIT (WAITALL PARAMETERS: no parameters
The analog of WAIT command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD PARAMETERS:
Alias of TOWAIT command.

command (or using of UNFIX command).

) then the command will ignore it and wait for a next packet (see also SENDWAITOTHER PARAMETERS: no parameters
Works similar to "SEND WAITALL" sentence. Purpose: make atomic operation. Without this command there would be a chance that a waited packet did not cause command WAITALL stop waiting if it was accepted after SEND but before WAITALL started waiting. However it would be registered as received in any case. This command should be always used when you need to send a request and RELIABLY receive a response on it never missing.

command.

command (or using of UNFIX PARAMETERS: no parameters
By default after the work of WAIT command (its analogs) the statuses for all waited packets will be fixed, so there may be no packets to wait for the next call to WAIT. This command marks these old packets as newly added. The previous status for them will be lost. Take a note of that ALL old packets will be unfixed, so they will be waited: this may cause unexpected results. Consider the use of CLEARREG PARAMETERS: no parameters
Clears the information about all the packets which were added to the waited ones (by WAIT, ADD PARAMETERS:
Alias of TOWAIT command.

commands). They will not be displayed in final report (or in the report that is displayed by SHOWREP PARAMETERS: no parameters
Displays a report which is the same as that displayed while program termination.

command). If this command is typed at the end of script then it omits the displaying of final report (sense there are no packet in it).

command.

command).

) then the command will ignore it and wait for a next packet (see also SENDWAITOTHER PARAMETERS: no parameters
Works similar to "SEND WAITALL" sentence. Purpose: make atomic operation. Without this command there would be a chance that a waited packet did not cause command WAITALL stop waiting if it was accepted after SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

and option -c) may simply separate packets one from another, so by this command the current content of buffer will be fixed and the new packet will be registered. The requests after command don't make sense in common regime (only while testing packet filter).

but before WAITALL PARAMETERS: no parameters
The analog of WAIT command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD PARAMETERS:
Alias of TOWAIT command.

command (or using of UNFIX command).

started waiting. However it would be registered as received in any case. This command should be always used when you need to send a request and RELIABLY receive a response on it never missing.

command.

before it.

tcp
NAME PARAMETERS: <name of packet>
Defines the name of currently described packet which will be displayed in report instead of not obvious "Packet on line ..."

tcp_packet
MES PARAMETERS: <string of message>
Defines the message which will be displayed the every time on receiving the currently described packet. Substitutions are allowed in the form of $name$. The 'name' may reference to the field's name, variable's name, someone defined by GDEF PARAMETERS: <new name> <original name>
Defines the substitution which will be applied while reading almost any read word from text. <New name> will be replaced by <original name>. This substitution may be also performed in strings enclosed in apostrophes. In this case the name must be enclosed in $ (ex: 'value = $name$').

command. In the case of field's name field's value will be retrieved from the content of received packet.

'tcp packet recieved from $srcip$:$srcport$ to $dstip$:$dstport$, syn = $syn$, rst = $rst$, fin = $fin$\n'
OR PARAMETERS:
Alias of TOWAIT PARAMETERS: {accept | drop | any }
Analog of WAIT command. Adds the above packet to the set of packets which will be waited by command WAIT or its analogs. This command does not start actual waiting (doesn't suspend script execution). Nevertheless, just after adding the packet may be registered as received. If some packet is registered as received before the call to WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

command (or using of UNFIX command).

command.

command). If this command is typed at the end of script then it omits the displaying of final report (sense there are no packet in it).

command.

command).

) then the command will ignore it and wait for a next packet (see also SENDWAITOTHER PARAMETERS: no parameters
Works similar to "SEND WAITALL" sentence. Purpose: make atomic operation. Without this command there would be a chance that a waited packet did not cause command WAITALL stop waiting if it was accepted after SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

command (or using of UNFIX command).

started waiting. However it would be registered as received in any case. This command should be always used when you need to send a request and RELIABLY receive a response on it never missing.

command.

QUIET PARAMETERS: no parameters
Instructs to not display some annoying messages.

CYC PARAMETERS: <number of iterations>
Command instructs that next WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in DEFAULTS PARAMETERS: {accept | drop | any | REVERS PARAMETERS: not command
Request specification. May only be given in parameters for DEFAULT command. Instructs to reverse the request for every packet.

}
Defines default requests for packets. These requests will be applied when there are not enough explicitly defined requests for some packet (specified as parameters to command SEND, WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

and its analogs). Initially default requests are ACCEPT ANY ANY... i.e. a single request for the first interface specified via option -d.

(command DEFAULT). For TCP DEVICE PARAMETERS: <type of device> {<name of interface>}
Reopens interfaces. The type of device: eth, ip, tcp. The name of device is the same as for -d option, depends on the type of device. New line terminates the list of names.

the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT PARAMETERS: {accept | drop | any }
Analog of WAIT command. Adds the above packet to the set of packets which will be waited by command WAIT or its analogs. This command does not start actual waiting (doesn't suspend script execution). Nevertheless, just after adding the packet may be registered as received. If some packet is registered as received before the call to WAIT (WAITALL PARAMETERS: no parameters
The analog of WAIT command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD PARAMETERS:
Alias of TOWAIT command.

command (or using of UNFIX command).

command.

command). If any of them is received then command terminates. Command waits packets until timeout expires (command TIMEOUT PARAMETERS: <interval in milliseconds>
Defines the timeout for WAIT command (and its analogs), also for imitation of application's work. Null value means infinite timeout (such timeout will not be applied for imitation of application's work). In the case of negative value its absolute value will be obtained as timeout, but WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

command (its analogs) will work differently: it will always wait for the whole timeout (not terminating on first received packet). So several packets may be registered as received. This command also defines the timeout for TCP server while waiting for connections.

). See "samples/waiting_packets.fws".

command (its analogs) or next block of script will be processed by several times = <number of iterations>. The "inf" value is available which means infinite iterant processing.

inf WAITALL PARAMETERS: no parameters
The analog of WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in DEFAULTS PARAMETERS: {accept | drop | any | REVERS PARAMETERS: not command
Request specification. May only be given in parameters for DEFAULT command. Instructs to reverse the request for every packet.

). See "samples/waiting_packets.fws".

and its analogs). Initially default requests are ACCEPT ANY ANY... i.e. a single request for the first interface specified via option -d.

command (or using of UNFIX command).

command.

command). If any of them is received then command terminates. Command waits packets until timeout expires (command TIMEOUT PARAMETERS: <interval in milliseconds>
Defines the timeout for WAIT command (and its analogs), also for imitation of application's work. Null value means infinite timeout (such timeout will not be applied for imitation of application's work). In the case of negative value its absolute value will be obtained as timeout, but WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD PARAMETERS:
Alias of TOWAIT PARAMETERS: {accept | drop | any }
Analog of WAIT command. Adds the above packet to the set of packets which will be waited by command WAIT or its analogs. This command does not start actual waiting (doesn't suspend script execution). Nevertheless, just after adding the packet may be registered as received. If some packet is registered as received before the call to WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

command (or using of UNFIX command).

command.

command). If this command is typed at the end of script then it omits the displaying of final report (sense there are no packet in it).

command.

command).

) then the command will ignore it and wait for a next packet (see also SENDWAITOTHER PARAMETERS: no parameters
Works similar to "SEND WAITALL" sentence. Purpose: make atomic operation. Without this command there would be a chance that a waited packet did not cause command WAITALL stop waiting if it was accepted after SEND PARAMETERS: {accept | drop | any }
In common regime generates the packet defined above. In other regimes (testing packet filter, see command FASTTEST PARAMETERS: no parameters
Enables fasttest regime for packet filter test. See "samples/fasttest".

command (or using of UNFIX command).

started waiting. However it would be registered as received in any case. This command should be always used when you need to send a request and RELIABLY receive a response on it never missing.

command.

command (or using of UNFIX PARAMETERS: no parameters
By default after the work of WAIT command (its analogs) the statuses for all waited packets will be fixed, so there may be no packets to wait for the next call to WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

. This command marks these old packets as newly added. The previous status for them will be lost. Take a note of that ALL old packets will be unfixed, so they will be waited: this may cause unexpected results. Consider the use of CLEARREG PARAMETERS: no parameters
Clears the information about all the packets which were added to the waited ones (by WAIT PARAMETERS: {accept | drop | any }
Waits for packet whose mask is defined above. The command will finish work when such packet is received on waitable interface. The waitable interface is interface for which strict request (accept or drop) have been specified in parameters to command or in defaults (command DEFAULT). For TCP device the command will only wait data on the main interface. In the general case command may wait no one but several packets (added by ADD PARAMETERS:
Alias of TOWAIT command.

). See "samples/waiting_packets.fws".

, ADD PARAMETERS:
Alias of TOWAIT PARAMETERS: {accept | drop | any }
Analog of WAIT command. Adds the above packet to the set of packets which will be waited by command WAIT or its analogs. This command does not start actual waiting (doesn't suspend script execution). Nevertheless, just after adding the packet may be registered as received. If some packet is registered as received before the call to WAIT (WAITALL PARAMETERS: no parameters
The analog of WAIT command. Doesn't add the previously defined packet to the list of waited ones. Starts waiting simply. Packets may be already added by ADD PARAMETERS:
Alias of TOWAIT command.

command (or using of UNFIX command).

command.

command). If this command is typed at the end of script then it omits the displaying of final report (sense there are no packet in it).

command.

command).