ipaggcreate

Count the number of packets sent from each source address appearing in a PCAP file

$ ipaggcreate --src [path/to/file.pcap]

$ ipaggcreate --interface [eth0] --length

$ ipaggcreate --address-pairs --bytes [path/to/file.pcap]

ipaggcreate [OPTIONS] PREFIX [ tos TOS ] [ table TABLE ] [ protocol RTPROTO ] [ scope SCOPE ] [ type TYPE ]

PREFIX
    Aggregate route prefix (e.g., 10.0.0.0/8)

tos TOS
    Type-of-service filter (0-255)

dsfield DSFIELD
    DiffServ field filter

table TABLE
    Routing table ID or name (default main)

protocol RTPROTO
    Route protocol (e.g., kernel, static, bgp)

scope SCOPE
    Route scope (global, link, host)

type TYPE
    Aggregate type: unicast, local, broadcast, blackhole, unreachable, prohibit, throw

-4
    Force IPv4

-6
    Force IPv6

metric NUMBER
    Route metric for preference

dev IFNAME
    Interface name (for scoped routes)

ipaggcreate is a utility from early versions of the iproute2 suite used to create aggregate IP routes in the Linux kernel's routing table. Aggregate routes summarize multiple specific routes into one entry, reducing table size and aiding in network summarization, often for BGP peering or default routing.

These routes match packets based on prefix without forwarding them directly; instead, they trigger actions like blackhole (drop), unreachable (ICMP unreachable), prohibit (admin prohibited), or throw (search other tables). This is key for policy-based routing and traffic engineering.

In modern iproute2 (post-2000s), this functionality merged into the unified ip route add type aggregate PREFIX syntax. ipaggcreate may appear in legacy systems, custom builds, or wrappers. It supports IPv4/IPv6, multiple tables, and metrics for preference.

Usage typically involves specifying prefix, scope (global/link), protocol (kernel/static/BGP), and type. Example: create a summary for 192.168.0.0/16 blackholing unmatched traffic. Always verify with ip route show table all. Deprecated in favor of flexible ip route for better integration with nexthop objects and ECMP.

Deprecated in modern iproute2; use ip route add type aggregate PREFIX instead. May not exist in current distributions. Requires root privileges.

ipaggcreate 192.168.0.0/16 blackhole table 100
Creates blackhole aggregate in table 100.

Use ip route show table all type aggregate to list.

Introduced in early iproute2 by Alexey Kuznetsov (1990s-2002) as rtaggadd variant. Unified into ip route subcommand around v2.4 kernels for consistency. Still in some embedded/legacy systems.

ip-route(8), ip(8), route(8), ss(8)