Packetdrill script analysis guide

Nearly period of time , Black box testing is more and more ,packetdrill What you use will rise , The amount of scripts is expanding . But , The information on the Internet is still poor , Had to grope forward . Eh, Shhh ！ Have to constantly evolve in the face of a wall .

about packetdrill, It's not difficult to write a lot of scripts , What is abhorrent is the understanding of the script . Google treat packetdrill The attitude is no better than that of other children , Besides writing specifications and a bunch of examples , It's hard to find other script Guides . therefore , Had a hard time with the script .

But there is no way. , Unless I'm willing to spend a lot of time deconstructing the code , But I didn't , My purpose is to use packetdrill To achieve my goal , That's it ！

But after a lot of trial and error and script analysis , I still felt it packetdrill Some context in script definition and analysis , So I can't wait Google Update , It was intended to be disclosed before it , The reason is nothing more than , Want to make packetdrill Be known and used by more people , since Google Not yet , I'll just add a little bit first .

A correct script , The key point is the writing of injection package and inspection package . Other parts , Convenient to be “ terminal ” Check it out . Only here , After mastering certain logic , You can easily write your own scripts and analyze others' scripts .

According to the diagram , A little bit to deconstruct packetdrill Script .

Or did you take it TCP give an example .

First ,packetdrill When writing a script , Will play C/S A character of , It could be the client , Or the receiving end . After confirming the role , Should learn to stand on this point of view .

For three handshakes ,packetdrill Always from client To server The handshake , There is no need to worry , This is almost the same in the script .

stay TCP established in , Contract operation Is triggered from the character , and “ACK The reply ” Naturally, it is triggered at the opposite end . therefore packetdrill For injection packages , Both ends can be injected , Just pay attention to “ Contract operation ” and “ACK The reply ” The standard of .

and packetdrill For inspection packages , It is slightly different from the injection package .

When inspecting the package ,packetdrill Always only in the role you play Inspection point , Only verify your own end . And because the opposite end is unmanageable （ There are no checkpoints ）, So you can't do the opposite end “ Package behavior ” test .

Follow the diagram , If we stand server End .

+0 > . 1:1(0) ack 7001 win 257

It's wrong to write like this . But we always make such mistakes , I don't know .

Last ,packetdrill Four waves are also from client To server, There is nothing to say , Put an end to this .

---

At the end

packetdrill It is an easy-to-use black box network verification tool , On collocation EBPF Basically, we can get twice the result with half the effort .

It hurts , -- Google about packetdrill The neglect of . But it doesn't matter ,packetdrill Leveraging on open source , There is still a long way to go .

After finish , Discovery is not like a guide , But it seems that I can't think of any suitable title , So let's go .