CERT/CC
background
background
CERT NetSA Security Suite 
Open Source Tools for Network Monitoring 
News | Documentation | Downloads
YAF 0.8.1 | NAF 0.6.0 | SiLK 1.0.1 | RAVE 1.9.9
fixbuf 0.7.3 | ipa 0.2.1 | airdbc 0.2.2 | airframe 0.7.2 | Portal 0.8.0
SiLK - Documentation - rwpmapcat
Documentation | Downloads | Release Notes | FAQ | License | Credits | Reference Data | Live CD


NAME

rwpmapcat - Print each IP range and label present in a prefix map file


SYNOPSIS

  rwpmapcat --map-file=PMAP_FILE [--output-type={ranges | labels}]
        [--ignore-label=LABEL] [--ip-label-to-ignore=IP_ADDRESS]
        [--no-cidr-blocks] [{--integer-ips | --zero-pad-ips}]
        [--no-titles] [--no-columns] [--column-separator=C]
        [--no-final-delimiter] [{--delimited | --delimited=C}]
        [--pager=PAGER_PROG]


DESCRIPTION

rwpmapcat reads a prefix map (pmap) file and prints the IP address block and the label associated with that block for every IPv4 address. The address blocks are printed in CIDR notation unless the --no-cidr-blocks switch is specified, in which case blocks are printed as a starting and ending IP address.

To only see the labels in a pmap file, specify --output-type=labels.

The printing of address blocks having a specific label may be suppressed with the --ignore-label switch. To have rwpmapcat to look up a label based on an IP address and then ignore all entries with the label, pass the IP address to the --ip-label-to-ignore switch.


OPTIONS

Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.

--map-file=PMAP_FILE
Specify the path of the prefix map file to print. This switch is required.

--output-type={label | ranges}
Specify the type of output to produce. The output-type can be specified using the shortest unique prefix for the type.
label
Print the names of the labels that exist in the pmap file.

ranges
Print an IP block in CIDR notation and the label for that block for each block in the pmap file.

--ignore-label=LABEL
For the ranges output-type, skip the printing of entries whose label is LABEL. By default, all IP--label pairs are printed.

--ip-label-to-ignore=IP_ADDRESS
For the ranges output-type, skip the printing of entries that have the same label as the specified IP_ADDRESS. By default, all IP--label pairs are printed.

--no-cidr-blocks
Cause each IP address block to be printed as a starting and ending IP address. By default, IP addresses are grouped into CIDR blocks.

--integer-ips
Cause IP addresses to be printed as integers. The default is print IP addresses as dotted-decimal.

--zero-pad-ips
Cause IP addresses to be printed as dotted decimal, but each octet is padded with zeros so that each is three characters wide. The default is print IP addresses as dotted-decimal with no padding.

--no-titles
Turn off column titles. By default, titles are printed.

--no-columns
Disable fixed-width columnar output.

--column-separator=C
Use specified character between columns and after the final column. When this switch is not specified, the default of '|' is used.

--no-final-delimiter
Do not print the column separator after the final column. Normally a delimiter is printed.

--delimited
--delimited=C
Run as if --no-columns --no-final-delimiter --column-sep=C had been specified. That is, disable fixed-width columnar output; if character C is provided, it is used as the delimiter between columns instead of the default '|'.

--pager=PAGER_PROG
When output is to a terminal, invoke the program PAGER_PROG to view the output one screen full at a time. This switch overrides the SILK_PAGER environment variable, which in turn overrides the PAGER variable. If the value of the pager is determined to be the empty string, no paging will be performed and all output will be printed to the terminal.


EXAMPLES

To print the contents of the prefix map file sample.pmap:

  $ rwpmapcat --map-file=sample.pmap
             ipBlock|       label|
           0.0.0.0/8|non-routable|
           1.0.0.0/8|    external|
           2.0.0.0/7|    external|
           4.0.0.0/6|    external|
           8.0.0.0/7|    external|
          10.0.0.0/8|non-routable|
          11.0.0.0/8|    external|
          12.0.0.0/6|    external|
          16.0.0.0/4|    external|
          ...

To not use CIDR notation in the output:

  $ rwpmapcat --map-file=sample.pmap --no-cidr-block
          startIP|          endIP|       label|
          0.0.0.0|  0.255.255.255|non-routable|
          1.0.0.0|  9.255.255.255|    external|
         10.0.0.0| 10.255.255.255|non-routable|
         11.0.0.0|126.255.255.255|    external|
        127.0.0.0|127.255.255.255|non-routable|
        128.0.0.0|169.253.255.255|    external|
      169.254.0.0|169.254.255.255|non-routable|
      169.255.0.0| 172.15.255.255|    external|
       172.16.0.0| 172.31.255.255|non-routable|
       172.32.0.0|    192.0.1.255|    external|
        192.0.2.0|    192.0.2.255|non-routable|
        192.0.3.0|192.167.255.255|    external|
      192.168.0.0|192.168.255.255|non-routable|
      192.169.0.0|255.255.255.254|    external|
  255.255.255.255|255.255.255.255|non-routable|

To print the labels in the file:

  $ rwpmapcat --map-file=sample.pmap --output-type=label
  LABELS:
  non-routable
  internal
  external

To ignore IPs with a particular label:

  $ rwpmapcat --map-file=sample.pmap --ignore-label=non-routable --no-cidr
          startIP|          endIP|       label|
          1.0.0.0|  9.255.255.255|    external|
         11.0.0.0|126.255.255.255|    external|
        128.0.0.0|169.253.255.255|    external|
      169.255.0.0| 172.15.255.255|    external|
       172.32.0.0|    192.0.1.255|    external|
        192.0.3.0|192.167.255.255|    external|
      192.169.0.0|255.255.255.254|    external|

To ignore those same values based on the IP:

  $ rwpmapcat --map-file=sample.pmap --ip-label-to-ignore=0.0.0.0
             ipBlock|       label|
           1.0.0.0/8|    external|
           2.0.0.0/7|    external|
           4.0.0.0/6|    external|
           8.0.0.0/7|    external|
          11.0.0.0/8|    external|
          12.0.0.0/6|    external|
          16.0.0.0/4|    external|
          32.0.0.0/3|    external|
          64.0.0.0/3|    external|
          ...


ENVIRONMENT

SILK_PAGER
When set to a non-empty string, rwpmapcat automatically invokes this program to display its output a screen at a time. If set to an empty string, rwpmapcat does not automatically page its output.

PAGER
When set and SILK_PAGER is not set, rwpmapcat automatically invokes this program to display its output a screen at a time.


SEE ALSO

rwpmapbuild(1), pmapfilter(3)