/*
    Changes content of trace file
 
    Runs as: anettest -d eth0 -f this_file.fws
 */

TRACE
   
PARAMETERS: <name of trace file>
Opens the given trace file for subsequent work with it.

 smtp_client.pcap  
// opens trace file

INCLUDE
   
PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE
   
PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without INCLUDE
   
PARAMETERS: <name of file>
Starts processing the content of given file. The search of file will be performed in the current directory, all search paths (see option -I). For every path the content of samples, headers, traces folders will be also examined. You can also type just the name of file without include before it.

 before it.

 before it.

 tcp

// defines the mask for packets which will be modified

CLEARMASK
   
PARAMETERS: no parameters
The mask of packet (the set of previously defined conditions) will be cleared. New mask will correspond to any packet. This command is usually contained in headers to make the mask correspond to all packets of given type (ex: TCP packets).


ethproto = ip
ip.proto = tcp
srcip 194.85.99.33

// performs modification

CHTRACE
   
PARAMETERS: "{" <block of script> "}"
The given block of script may contain field's values definitions or command PRINT
   
PARAMETERS: <message>
Displays the given message. Use symbol 
 in message to indicate that line feed must be performed.

. These definitions will be applied to every packet from trace file which corresponds the mask described before the command.

 {

	PRINTL
   
PARAMETERS: <message>
Analog of PRINT
   
PARAMETERS: <message>
Displays the given message. Use symbol 
 in message to indicate that line feed must be performed.

 command. Additionally performs the line feed.

 
'before:\n$fullpacket$\n'

   dstip 88.210.60.143
   dstport 25
   ip.len IPlen
   tcp.crc TCPcrc
   ip.crc IPcrc

   PRINT
   
PARAMETERS: <message>
Displays the given message. Use symbol 
 in message to indicate that line feed must be performed.

 
'$srcport$\n'
	PRINTL
   
PARAMETERS: <message>
Analog of PRINT
   
PARAMETERS: <message>
Displays the given message. Use symbol 
 in message to indicate that line feed must be performed.

 command. Additionally performs the line feed.

 
'after:\n$fullpacket$\n'
}

 // write 
// write file to disk