replaying captured traffic

Mailman List Mirror (Read Only)
1

I am hoping someone can provide wisdom regarding the dos and don’ts replaying captured traffic?

Is open source tools sufficient?

Can PCAPs be replayed?

How is this accomplished? partial rewriting IP headers

Recommended tools?

Mike

2

I am hoping someone can provide wisdom regarding the dos and don'ts
replaying captured traffic?

Googling 'pcap replay' yields many hits.

Is open source tools sufficient?

Can PCAPs be replayed?

This is an easy answer:

  https://tcpreplay.appneta.com/
  GitHub - appneta/tcpreplay: Pcap editing and replay tools for *NIX and Windows - Users please download source from

etc...

I've tried none of them.

3

Thanks Brian,

I am with you on the easy google fu, however, weeding through the challenges and a real implementation I was hoping to leverage some lessons learned and best practices.

Mike

4

Well, it's going to depend a *lot* on why exactly you're doing the replay.

Doing a replay for forensics, doing a replay for protocol/application
correctness testing, and doing a replay for throughput test load generation are
3 very different things.