NAME

       ptunnel - tunnel TCP connections over ICMP echo request/reply packets.

SYNOPSIS

       ptunnel  -p  proxy_address  -lp listen_port -da destination_address -dp dest_port [-c network_device] [-v
       verbosity] [-f file] [-udp] [-syslog]

       ptunnel [-c network_device] [-v verbosity] [-f file] [-udp] [-syslog] [-daemon file]

       ptunnel [-u] [-x password] [-setuid user] [-setgid group] [-chroot dir] [-setcon context]

       ptunnel -h

DESCRIPTION

       ptunnel is an application that allows you to reliably tunnel TCP connections to a remote host using  ICMP
       echo  request and reply packets, commonly known as ping requests and replies. At first glance, this might
       seem like a rather useless thing to do, but it can actually come in handy in some  cases.  The  following
       example illustrates the main motivation in creating ptunnel:

       Setting:  You're  on  the  go,  and  stumble across an open wireless network. The network gives you an IP
       address, but won't let you send TCP or UDP packets out to the rest of the internet, for instance to check
       your  mail.  What  to do? By chance, you discover that the network will allow you to ping any computer on
       the rest of the internet. With ptunnel, you can utilize this feature to check  your  mail,  or  do  other
       things that require TCP.

OPTIONS

       Client options:

       -p proxy_address
              Specify the host on which the proxy is running.

       -lp listen_port
              Specifies the port on which the client will listen for incoming TCP connections.

       -da destination_addr
              Specifies  the  address  to  which you want your packets tunneled after reaching the proxy when in
              client mode, or restricts the destination packets can be forwarded to when in server mode.

       -dp destination_port
              Specifies/restrict the port that the proxy should tunnel the TCP connection to.

       Shared options:

       -c network_device
              Specify the network interface to capture packets from. Note that  packet  capturing  isn't  always
              necessary, but you should try this if you experience problems with ptunnel.

       -v verbosity
              Controls the verbosity level. -1 is no output, 0 shows errors only, 1 shows info messages, 2 gives
              more output, 3 provides even more output, level  4  displays  debug  info  and  level  5  displays
              absolutely everything, including the nasty details of sends and receives.

       -udp   Enables  tunneling over UDP port 53 (DNS) instead of using ICMP. This will only work if your proxy
              can accept incoming traffic on port 53, and the client is able to send data to the proxy  on  port
              53.  Note that this option does not wrap ptunnel's data in DNS-compliant packets. This option must
              be given on both the proxy and client side for things to work correctly.

       -syslog (Not available on Windows.)
              Changes logging to use the built-in syslog fascility.

       -daemon file (Not available on Windows.)
              Run in background, writing PID in file.

       -u     Attempts to run ptunnel without privileges. This doesn't usually  work!  On  UNIX  systems  please
              consider using the following three options instead:

       -setuid user (Not available on Windows.)
              When started in privileged mode, drop down to user's rights as soon as possible.

       -setgid group (Not available on Windows.)
              When started in privileged mode, drop down to group's rights as soon as possible.

       -chroot dir (Not available on Windows.)
              When started in privileged mode, restrict file access to the specified directory.

       -setcon context (Not available on Windows.)
              Set  SELinux context when all there is left to do are network I/O operations.  In order to be able
              to combine with -chroot you will have to `mount --bind /proc /chrootdir/proc`

       -x password
              Specifies a password or passphrase to use. This will allow you to protect the proxy  from  use  by
              others who don't know the password. It needs to be specified on both proxy and client.

       -f file
              Specifies a log file. If you specify -syslog, syslog is always used instead.

       -h     Displays brief usage information.

EXAMPLES

       The  following  assumes  that  ptunnel  is  run  as  root,  both  on  the proxy and client. To tunnel ssh
       connections from the client  machine  via  a  proxy  running  on  proxy.pingtunnel.com  to  the  computer
       login.domain.com, the following command line would be used:

       ptunnel -p proxy.pingtunnel.com -lp 8000 -da login.domain.com -dp 22

       An ssh connection to login.domain.com can now be established as follows:

       ssh -p 8000 localhost

       If  ssh  complains  about  potential  man-in-the-middle attacks, simply remove the offending key from the
       known_hosts file. The warning/error is expected if you have  previously  ssh'd  to  your  local  computer
       (i.e., ssh localhost), or you have used ptunnel to forward ssh connections to different hosts.

       Of   course,   for   all  of  this  to  work,  you  need  to  start  the  proxy  on  your  proxy-computer
       (proxy.pingtunnel.com). Doing this is very simple:

       ptunnel

       If you find that the proxy isn't working, you will need to enable packet capturing on  the  main  network
       device.  Currently  this  device is assumed to be an ethernet-device (i.e., ethernet or wireless). Packet
       capturing is enabled by giving the -c switch, and supplying the device name to capture  packets  on  (for
       instance eth0 or en1). The same goes for the client. On Mac OS X, packet capturing must always be enabled
       (both for proxy and client), as resent packets won't be received otherwise.

       To protect yourself from others using your proxy, you can protect access to it with a password using  the
       <tt>-x</tt> switch. The password is never sent in the clear, but keep in mind that it may be visible from
       tools like top or ps, which can display the command line used to start an application.

EXIT STATUS

       ptunnel does not exit until forced to do so by an interrupt (Ctrl-C) or if it crashes.

BUGS

       ptunnel currently does not handle packet capturing on network interfaces other than ethernet or  wireless
       correctly.

AUTHORS AND CONTRIBUTORS

       Daniel Stoedle (daniels@cs.uit.no)

       Windows port: Mike Miller (mike@mikeage.net)

       SELinux support: Sebastien Raveau (sebastien.raveau@epita.fr)

       Patches: Joe McKenzie, Steffen Wendzel and StalkR.

LICENSE

       ptunnel is licensed under the BSD License.

AVAILABILITY

       The ptunnel homepage is currently located here:
              http://www.cs.uit.no/~daniels/PingTunnel/

       The freshmeat project page is located here:
              http://freshmeat.net/projects/ptunnel/

       Please take the time to rate ptunnel if you find it useful. Thanks!