RANDPKT(1)

📦
version 4.7.4 · 17 versions
, in arch rolling

🎀 RANDPKT — random packet generator, she's a chaos gremlin and we love her 🎀

Okay so real quick — this whole page is from the randpkt(1) manual, bestie. It's a tiny little Unix utility that just... makes garbage packets on purpose. Iconic behavior honestly.

✨ SYNOPSIS ✨

randpkt [ -b <maxbytes> ] [ -c <count> ] [ -F <file format> ] [ -r ]
[ -t <type> ] <filename>

randpkt -h|--help

randpkt -v|--version

Like, that's the whole vibe. You give her a <filename> and some flags and she goes off. 💅

💖 DESCRIPTION 💖

Okay so randpkt is a small utility that creates a trace file full of random packets. Literally just chaos in a file.

And why would you want that? Because by creating many randomized packets of a certain type, you can test packet sniffers to see how well they handle malformed packets. Think of it as a vibe check for your sniffer 🔥 — the sniffer can never trust the data that it sees in the packet, because you can always sniff a very bad packet that doesn't conform to any standard. And randpkt? She produces very bad packets. On purpose. That's her whole thing. Periodt. 💀

Here's the trick, though: when creating packets of a certain type, randpkt uses a sample packet that is stored internally to randpkt. She uses this as the starting point for your random packets, and then adds extra random bytes to the end of this sample packet. So it's like... structured chaos. Main character energy. 🌸

For example, if you choose to create random ARP packets, randpkt will create a packet which contains a predetermined Ethernet II header, with the Type field set to ARP. After the Ethernet II header, it will put a random number of bytes with random values. Chef's kiss. 🫶

🦋 OPTIONS 🦋

  • -b <maxbytes> — default 5000, bestie. This defines the maximum number of bytes added to the sample packet. Here's the important part: if you choose a maxbytes value that is less than the size of the sample packet, then your packets would contain only the sample packet... not much variance there! And randpkt exits on that condition. So don't do that. 🙈
  • -c <count> — default 1000. Defines the number of packets to generate. Simple as that. ✨
  • -F <file format> — default pcapng. Sets the file format of the output capture file. randpkt can write the file in several formats; randpkt -F provides a list of the available output formats. Heads up though — note that not all output formats support all packet types. F in the chat for the combos that just don't work 😭
  • -h|--help — Print the version number and options and exit. Your classic "help me bestie" flag. 💜
  • -r — The packet type is determined randomly for each packet. This requires an output format that can support different encapsulations per packet, like pcapng. So if you want maximum chaos — random type per packet — this is the slay. 🔥
  • -t <type> — default is an Ethernet II frame. Defines the type of packet to generate, and here's the full menu:
    • arp — Address Resolution Protocol
    • bgp — Border Gateway Protocol
    • bvlc — BACnet Virtual Link Control
    • dns — Domain Name Service
    • eth — Ethernet
    • fddi — Fiber Distributed Data Interface
    • giop — General Inter-ORB Protocol
    • icmp — Internet Control Message Protocol
    • ip — Internet Protocol
    • ipv6 — Internet Protocol Version 6
    • llc — Logical Link Control
    • m2m — WiMAX M2M Encapsulation Protocol
    • megaco — MEGACO
    • nbns — NetBIOS-over-TCP Name Service
    • ncp2222 — NetWare Core Protocol
    • sctp — Stream Control Transmission Protocol
    • syslog — Syslog message
    • tds — TDS NetLib
    • tcp — Transmission Control Protocol
    • tr — Token-Ring
    • udp — User Datagram Protocol
    • usb — Universal Serial Bus
    • usb-linux — Universal Serial Bus with Linux specific header

Obsessed with this list ngl. 🍓

  • -v|--version — Print the full version information and exit. Gotta know which version ate. 👑

🌈 DIAGNOSTIC OPTIONS 🌈

These are the log-gremlin options, iykyk. 🧚

  • --log-level <level> — Set the active log level. Supported levels in lowest to highest order are "noisy", "debug", "info", "message", "warning", "critical", and "error". Messages at each level and higher will be printed — for example "warning" prints "warning", "critical", and "error" messages, and "noisy" prints all messages. Levels are case insensitive. 💅
  • --log-fatal <level> — Abort the program if any messages are logged at the specified level or higher. For example, "warning" aborts on any "warning", "critical", or "error" messages. Dramatic but valid. 💀
  • --log-fatal-count <count> — The amount of fatal log messages which may pass before the program is aborted. Like a little grace period. 🎀
  • --log-domains <list> — Only print messages for the specified log domains, e.g. "GUI,Epan,sshdump". List of domains must be comma-separated. Can be negated with "!" as the first character (inverts the match). ⭐
  • --log-debug <list> — Force the specified domains to log at the "debug" level. List of domains must be comma-separated. Can be negated with "!" as the first character (inverts the match). 🦋
  • --log-noisy <list> — Force the specified domains to log at the "noisy" level. List of domains must be comma-separated. Can be negated with "!" as the first character (inverts the match). 📣
  • --log-fatal-domains <list> — Abort the program if any messages are logged for the specified log domains. List of domains must be comma-separated. No negation here, just vibes. 🙈
  • --log-file <path> — Write log messages and stderr output to the specified file. Everything into one file, neat and tidy. ✨

🌸 EXAMPLES 🌸

Bestie, let's actually do stuff.

To see a description of the randpkt options use:

randpkt

To generate a capture file with 1000 DNS packets use:

randpkt -b 500 -t dns rand_dns.pcapng

To generate a small capture file with just a single LLC frame use:

randpkt -b 100 -c 1 -t llc single_llc.pcapng

Literally so easy. Go forth and generate bad packets. 🔥

👑 SEE ALSO 👑

pcap(3), editcap(1) — go read those too, they're part of the family. 💖

Ok that's the whole page, no cap. Every flag, every default, every domain, every byte count — it's all up there. 🫶

Signing off with love: this was the RANDPKT(1) manual page, and the date on her little name tag says 2026-10-08. Mwah. 💋🎀

📦 where this page comes from