CERT/CC
background
background
CERT NetSA Security Suite 
Open Source Tools for Network Monitoring 
News | Documentation | Downloads
YAF 0.8.1 | NAF 0.6.0 | SiLK 1.0.1 | RAVE 1.9.9
fixbuf 0.7.3 | ipa 0.2.1 | airdbc 0.2.2 | airframe 0.7.2 | Portal 0.8.0
SiLK - Documentation - rwsetcat
Documentation | Downloads | Release Notes | FAQ | License | Credits | Reference Data | Live CD


NAME

rwsetcat - Print the IP addresses in a binary IPset file


SYNOPSIS

  rwsetcat [--count-ips] [--print-statistics] [--print-ips]
        [{--integer-ips | --zero-pad-ips}] [--cidr-blocks]
        [--network-structure[={T | A | B | C | X | H}...[S]]]
        [--ip-ranges] [--no-columns] [--column-separator=C]
        [--no-final-delimiter] [{--delimited | --delimited=C}]
        [--pager=PAGER_PROG] [SET_FILE...]


DESCRIPTION

When run with no switches, rwsetcat reads each IPset file given on the command line and prints its constituent IP addresses to the standard output, with one IP address per line. If no file names are listed on the command line, rwsetcat will attempt to read an IPset from the standard input.

rwsetcat can produce additional information about IPset files, such as the number of IPs they contain, the number of IPs at the /8, /16, /24, and /27 levels, and the minimum and maximum IPs.


OPTIONS

Option names may be abbreviated if the abbreviation is unique or is an exact match for an option. A parameter to an option may be specified as --arg=param or --arg param, though the first form is required for options that take optional parameters.

--count-ips
Print a count of IP addresses in the IPset file. When this switch is the only one specified, the IPs in the IPset file will not be printed.

--print-statistics
Print statistics about the IPset. The statistics include the minimum IP address, the maximum IP address, and, for each CIDR block of /8, /16, /24, /27, and /32, the number of blocks occupied and what percentage of coverage that represents. When this switch is the only one specified, the IPs in the IPset file will not be printed.

--print-ips
Force printing of the IP addresses, even when the --count-ips or --print-statistics option is provided.

--integer-ips
Cause IP addresses to be printed as integers.

--zero-pad-ips
Cause IP addresses to be printed as dotted decimal, but each octet is padded with zeros so that each is three characters wide.

--cidr-blocks
Print the IPs in the binary IPset file, but it causes the sequential IPs to be grouped into the largest possible CIDR block. This switch cannot be combined with the --network-structure switch.

--network-structure[={T | A | B | C | X | H}...[S]]
Print the network structure around the IP addresses in the binary IPset file.
T
total network header and host count

A
class A (/8) network header and host count

B
class B (/16) network header and host count

C
class C (/24) network header and host count

X
(/27) network header and host count

H
individual IP addresses

S
count of /8,/16,/24,/27s in each smaller subnet

If no argument is specified, the default is TS. Any combination of T,A,B,C,X,H may be specified; the S argument by itself is illegal.

This option will disable printing of the IPs in the IPset file; specify the H argument to the switch to print the IP addresses.

--ip-ranges
Cause the output to contain three columns: the first is the number of IPs in the contiguous range, the second is the start of the range, and the final is the end of the range. This is the most compact way to print the output.

--no-columns
Disable fixed-width columnar output when printing the output from the --network-structure or --ip-ranges swtich.

--column-separator=C
Use specified character between columns produced by the --network-structure and --ip-ranges swtiches. This character is also used after the final column when --ip-ranges is specified. When this switch is not specified, the default of '|' is used.

--no-final-delimiter
Do not print the column separator after the final column in the output produced by --ip-ranges. Normally a delimiter is printed.

--delimited
--delimited=C
Run as if --no-columns --no-final-delimiter --column-sep=C had been specified. That is, disable fixed-width columnar output; if character C is provided, it is used as the delimiter between columns instead of the default '|'.

--pager=PAGER_PROG
When output is to a terminal, invoke the program PAGER_PROG to view the output one screen full at a time. This switch overrides the SILK_PAGER environment variable, which in turn overrides the PAGER variable. If the value of the pager is determined to be the empty string, no paging will be performed and all output will be printed to the terminal.


EXAMPLES

Print the contents of a IPset.

  $ rwsetcat sample.set
  10.1.2.250
  10.1.2.251
  10.1.2.252
  10.1.2.253
  10.1.2.254
  10.1.2.255
  10.1.3.0
  10.1.3.1
  10.1.3.2
  10.1.3.3
  10.1.3.4

To get the contents in CIDR notation:

  $ rwsetcat --cidr-blocks sample.set
  10.1.2.250/31
  10.1.2.252/30
  10.1.3.0/30
  10.1.3.4

To see contiguous IPs printed as ranges:

  $ rwsetcat --ip-ranges sample.set
          11|     10.1.2.250|       10.1.3.4|

To see contiguous IPs printed as ranges of integers:

  $ rwsetcat --ip-ranges --integer-ips sample.set
          11| 167838458| 167838468|

To count the IPs in the IPset:

  $ rwsetcat --count-ips sample.set
  11

To see the contents of the IPset and get a count of IPs, use multiple options:

  $ rwsetcat --count-ips --cidr-blocks sample.set
  11
  10.1.2.250/31
  10.1.2.252/30
  10.1.3.0/30
  10.1.3.4

For text-based sorting, use the --zero-pad-ips switch to force three digits per octet:

  $ rwsetcat --zero-pad-ips --cidr-blocks sample.set
  010.001.002.250/31
  010.001.002.252/30
  010.001.003.000/30
  010.001.003.004

For numerical sorting, print as an integer:

  $ rwsetcat --integer-ips sample.set
  167838458
  167838459
  167838460
  167838461
  167838462
  167838463
  167838464
  167838465
  167838466
  167838467
  167838468

Use the --print-statistics and --network-structure switches for more detailed information:

  $ rwsetcat --print-statistics sample.set
  Network Summary
          minimumIP = 10.1.2.250
          maximumIP = 10.1.3.4
                  11 hosts (/32s),    0.000000% of 2^32
                   1 occupied /8,     0.390625% of 2^8
                   1 occupied /16,    0.001526% of 2^16
                   2 occupied /24s,   0.000012% of 2^24
                   2 occupied /27s,   0.000001% of 2^27
  $ rwsetcat --network-structure=TABCXS sample.set
          10.1.2.224/27     | 6 hosts
        10.1.2.0/24         | 6 hosts in 1 /27
          10.1.3.0/27       | 5 hosts
        10.1.3.0/24         | 5 hosts in 1 /27
      10.1.0.0/16           | 11 hosts in 2 /24s and 2 /27s
    10.0.0.0/8              | 11 hosts in 1 /16, 2 /24s, and 2 /27s
  TOTAL                     | 11 hosts in 1 /8, 1 /16, 2 /24s, and 2 /27s

To see the IPs generated by rwset without creating an intermediate IPset file, have rwset send its output to the standard output, and have rwsetcat read from stdin:

  $ rwfilter ... --pass=stdout | rwset --sip=stdout | rwsetcat
  192.168.1.1
  192.168.1.2


ENVIRONMENT

SILK_PAGER
When set to a non-empty string, rwsetcat automatically invokes this program to display its output a screen at a time. If set to an empty string, rwsetcat does not automatically page its output.

PAGER
When set and SILK_PAGER is not set, rwsetcat automatically invokes this program to display its output a screen at a time.


SEE ALSO

rwset(1), rwsetbuild(1)