intercept (1)

intercept -OPTIONS [OPTION_PARAM]

TCPCopy is an online request replication tool using netlink and raw sockets. It can copy TCP flows from production environment to testing environment in real-time with very small impact on normal operation, so that it is a very handful tool for distributed stress testing, hot backup, online testing and benchmarking.

-x <PASSLIST,>

Passed IP list through firewall, format: IP1,IP2,...

-b <IP>

Bind IP address for listening.

-d

Run as daemon.

-l <LOG_FILE>

Save logs in LOG_FILE

-p <PORT>

Set the TCP port number to listen on. Default value is 36524.

-P <PIDFILE>

Save PID in PIDFILE , only use in conjunction with -d option.

-s <NUM>

Set the hash table size for intercept. Default value is 65536.

-t <SEC>

Set the router item timeout limit in seconds. Default value is 120.

-h

Print help text and exit.

-v

Print version info and exit.

This program relies on the function of ip_queue module, you can check whether the module has been loaded by running: lsmod | grep ip_queue If it is not loaded, use modprobe ip_queue to load it.

After loading the ip_queue module, you need to set up iptables to queue requests for the port when are intercepting: iptables -I OUTPUT -p tcp --sport PORT -j QUEUE

When the presure is heavy, turning sysctl parameters may be necessary for better performance and lower packet (request) loss rate.

The status of ip_queue module can be found at /proc/net/ip_queue , if the number of Queue dropped is increasing, then it suggests net.ipv4.ip_queue_maxlen may need to be increased, and if Netlink dropped is increasing, then net.core.rmem_max and net.core.wmem_max may need to be increased.

It is also recommended to stop tcpcopy(1) before stopping intercept(1).

tcpcopy(1), /usr/share/doc/tcpcopy/README

This manual page was written by Aron Xu <[email protected]> for the Debian GNU/Linux system (but may be used by others).