1tcpreplay(1)                     User Commands                    tcpreplay(1)
2
3
4

NAME

6       tcpreplay - Replay network traffic stored in pcap files
7

SYNOPSIS

9       tcpreplay   [-flags]   [-flag   [value]]   [--option-name[[=|  ]value]]
10       <pcap_file(s)>
11
12       tcpreplay is a tool for replaying network traffic from files saved with
13       tcpdump or other tools which write pcap(3) files.
14

DESCRIPTION

16       The  basic operation of tcpreplay is to resend  all  packets  from  the
17       input file(s) at the speed at which they were recorded, or a  specified
18       data rate, up to as fast as the hardware is capable.
19
20       Optionally, the traffic can be split between two interfaces, written to
21       files, filtered and edited in various ways, providing the means to test
22       firewalls, NIDS and other network devices.
23
24       For  more  details,  please  see the Tcpreplay Manual at: http://tcpre
25       play.appneta.com
26

OPTIONS

28       -d number, --dbug=number
29              Enable debugging output.  This option may appear up to 1  times.
30              This  option takes an integer number as its argument.  The value
31              of number is constrained to being:
32                  in the range  0 through 5
33              The default number for this option is:
34                   0
35
36              If configured with --enable-debug, then you can specify a ver‐
37              bosity level for debugging output.  Higher numbers increase ver‐
38              bosity.
39
40       -q, --quiet
41              Quiet mode.
42
43              Print nothing except the statistics at the end of the run
44
45       -T string, --timer=string
46              Select packet timing mode: select, ioport, gtod, nano.  This op‐
47              tion may appear up to 1 times.  The default string for this op‐
48              tion is:
49                   gtod
50
51              Allows you to select the packet timing method to use:
52
53              nano - Use nanosleep() API
54
55              select - Use select() API
56
57              ioport - Write to the i386 IO Port 0x80
58
59              gtod [default] - Use a gettimeofday() loop
60
61       --maxsleep=number
62              Sleep for no more then X milliseconds between packets.  This op‐
63              tion takes an integer number as its argument.  The default num‐
64              ber for this option is:
65                   0
66
67              Set a limit for the maximum number of milliseconds that tcpre‐
68              play will sleep between packets.  Effectively prevents long de‐
69              lays between packets without effecting the majority of packets.
70              Default is disabled.
71
72       -v, --verbose
73              Print decoded packets via tcpdump to STDOUT.  This option may
74              appear up to 1 times.
75
76
77       -A string, --decode=string
78              Arguments passed to tcpdump decoder.  This option may appear up
79              to 1 times.  This option must appear in combination with the
80              following options: verbose.
81
82              When enabling verbose mode (-v) you may also specify one or more
83              additional  arguments to pass to tcpdump to modify the way pack‐
84              ets are decoded.  By default, -n and -l are used.   Be  sure  to
85              quote the arguments like: -A "-axxx" so that they are not inter‐
86              preted by tcpreplay.   Please see the tcpdump(1) man page for a
87              complete list of options.
88
89       -K, --preload-pcap
90              Preloads packets into RAM before sending.
91
92              This option loads the specified pcap(s) into RAM before starting
93              to send in order to improve replay performance while introducing
94              a startup performance hit.  Preloading can be used with or with‐
95              out --loop. This option also suppresses flow statistics collec‐
96              tion for every iteration, which can significantly reduce memory
97              usage. Flow statistics are predicted based on options supplied
98              and statistics collected from the first loop iteration.
99
100       -c string, --cachefile=string
101              Split traffic via a tcpprep cache file.  This option may appear
102              up to 1 times.  This option must appear in combination with the
103              following options: intf2.  This option must not appear in combi‐
104              nation with any of the following options: dualfile.
105
106              If you have a pcap file you would like to use to send bi-direc‐
107              tional traffic through a device (firewall, router, IDS, etc)
108              then using tcpprep you can create a cachefile which tcpreplay
109              will use to split the traffic across two network interfaces.
110
111       -2, --dualfile
112              Replay two files at a time from a network tap.  This option may
113              appear up to 1 times.  This option must appear in combination
114              with the following options: intf2.  This option must not appear
115              in combination with any of the following options: cachefile.
116
117              If you captured network traffic using a network tap, then you
118              can end up with two pcap files- one for each direction.  This
119              option will replay these two files at the same time, one on each
120              interface and inter-mix them using the timestamps in each.
121
122       -i string, --intf1=string
123              Client to server/RX/primary traffic output interface.  This op‐
124              tion may appear up to 1 times.
125
126              Required network interface used to send either all traffic or
127              traffic which is marked as 'primary' via tcpprep.  Primary traf‐
128              fic is usually client-to-server or inbound (RX) on khial virtual
129              interfaces.
130
131       -I string, --intf2=string
132              Server to client/TX/secondary traffic output interface.  This
133              option may appear up to 1 times.
134
135              Optional network interface used to send traffic which is marked
136              as 'secondary' via tcpprep.  Secondary traffic is usually
137              server-to-client or outbound (TX) on khial virtual interfaces.
138              Generally, it only makes sense to use this option with
139              --cachefile.
140
141       --listnics
142              List available network interfaces and exit.
143
144
145       -l number, --loop=number
146              Loop through the capture file X times.  This option may appear
147              up to 1 times.  This option takes an integer number as its argu‐
148              ment.  The value of number is constrained to being:
149                  greater than or equal to 0
150              The default number for this option is:
151                   1
152
153
154       --loopdelay-ms=number
155              Delay between loops in milliseconds.  This option must appear in
156              combination with the following options: loop.  This option takes
157              an integer number as its argument.  The value of number is con‐
158              strained to being:
159                  greater than or equal to 0
160              The default number for this option is:
161                   0
162
163
164       --pktlen
165              Override the snaplen and use the actual packet len.  This option
166              may appear up to 1 times.
167
168              By default, tcpreplay will send packets based on the size of the
169              "snaplen" stored in the pcap file which is usually the correct
170              thing to do.  However, occasionally, tools will store more bytes
171              then told to.  By specifying this option, tcpreplay will ignore
172              the snaplen field and instead try to send packets based on the
173              original packet length.  Bad things may happen if you specify
174              this option.
175
176       -L number, --limit=number
177              Limit the number of packets to send.  This option may appear up
178              to 1 times.  This option takes an integer number as its argu‐
179              ment.  The value of number is constrained to being:
180                  greater than or equal to 1
181              The default number for this option is:
182                   -1
183
184              By default, tcpreplay will send all the packets.  Alternatively,
185              you can specify a maximum number of packets to send.
186
187       --duration=number
188              Limit the number of seconds to send.  This option may appear up
189              to 1 times.  This option takes an integer number as its argu‐
190              ment.  The value of number is constrained to being:
191                  greater than or equal to 1
192              The default number for this option is:
193                   -1
194
195              By default, tcpreplay will send all the packets.  Alternatively,
196              you can specify a maximum number of seconds to transmit.
197
198       -x string, --multiplier=string
199              Modify replay speed to a given multiple.  This option may appear
200              up to 1 times.  This option must not appear in combination with
201              any of the following options: pps, mbps, oneatatime, topspeed.
202
203              Specify a value to modify the packet replay speed.  Examples:
204                      2.0 will replay traffic at twice the speed captured
205                      0.7 will replay traffic at 70% the speed captured
206
207       -p string, --pps=string
208              Replay packets at a given packets/sec.  This option may appear
209              up to 1 times.  This option must not appear in combination with
210              any of the following options: multiplier, mbps, oneatatime, top‐
211              speed.
212
213              Specify a value to regulate the packet replay to a specific
214              packet-per-second rate.  Examples:
215                      200 will replay traffic at 200 packets per second
216                      0.25 will replay traffic at 15 packets per minute
217
218       -M string, --mbps=string
219              Replay packets at a given Mbps.  This option may appear up to 1
220              times.  This option must not appear in combination with any of
221              the following options: multiplier, pps, oneatatime, topspeed.
222
223              Specify a floating point value for the Mbps rate that tcpreplay
224              should send packets at.
225
226       -t, --topspeed
227              Replay packets as fast as possible.  This option must not appear
228              in combination with any of the following options: mbps, multi‐
229              plier, pps, oneatatime.
230
231
232       -o, --oneatatime
233              Replay one packet at a time for each user input.  This option
234              must not appear in combination with any of the following op‐
235              tions: mbps, pps, multiplier, topspeed.
236
237              Allows you to step through one or more packets at a time.
238
239       --pps-multi=number
240              Number of packets to send for each time interval.  This option
241              must appear in combination with the following options: pps.
242              This option takes an integer number as its argument.  The value
243              of number is constrained to being:
244                  greater than or equal to 1
245              The default number for this option is:
246                   1
247
248              When trying to send packets at very high rates, the time between
249              each packet can be so short that it is impossible to accurately
250              sleep for the required period of time.  This option allows you
251              to send multiple packets at a time, thus allowing for longer
252              sleep times which can be more accurately implemented.
253
254       --unique-ip
255              Modify IP addresses each loop iteration to generate unique
256              flows.  This option must appear in combination with the follow‐
257              ing options: loop.
258
259              Ensure IPv4 and IPv6 packets will be unique for each --loop it‐
260              eration.  This is done in a way that will not alter packet CRC,
261              and therefore will genrally not affect performance. This option
262              will significantly increase the flows/sec over generated over
263              multiple loop iterations.
264
265       --unique-ip-loops=string
266              Number of times to loop before assigning new unique ip.  This
267              option may appear up to 1 times.  This option must appear in
268              combination with the following options: unique-ip.
269
270              Number of --loop iterations before a new unique IP is assigned.
271              Default is 1. Assumes both --loop and --unique-ip.
272
273       --netmap
274              Write packets directly to netmap enabled network adapter.
275
276              This feature will detect netmap capable network drivers on Linux
277              and BSD systems. If detected, the network driver is bypassed for
278              the execution duration, and network buffers will be written to
279              directly. This will allow you to achieve full line rates on com‐
280              modity network adapters, similar to rates achieved by commercial
281              network traffic generators. Note that bypassing the network
282              driver will disrupt other applications connected through the
283              test interface. See INSTALL for more information.
284
285              This feature can also be enabled by specifying an interface as
286              'netmap:<intf>' or 'vale:<intf>. For example 'netmap:eth0' spec‐
287              ifies netmap over interface eth0.
288
289       --nm-delay=number
290              Netmap startup delay.  This option takes an integer number as
291              its argument.  The default number for this option is:
292                   10
293
294              Number of seconds to delay after netmap is loaded. Required to
295              ensure interfaces are fully up before netmap transmit. Requires
296              netmap option. Default is 10 seconds.
297
298       --no-flow-stats
299              Suppress printing and tracking flow count, rates and expira‐
300              tions.
301
302              Suppress the collection and printing of flow statistics. This
303              option may improve performance when not using --preload-pcap op‐
304              tion, otherwise its only function is to suppress printing.
305
306              The flow feature will track and print statistics of the flows
307              being sent.  A flow is loosely defined as a unique combination
308              of a 5-tuple, i.e.  source IP, destination IP, source port, des‐
309              tination port and protocol.
310
311              If --loop is specified, the flows from one iteration to the next
312              will not be unique, unless the packets are altered. Use
313              --unique-ip or tcpreplay-edit to alter packets between itera‐
314              tions.
315
316       --flow-expiry=number
317              Number of inactive seconds before a flow is considered expired.
318              This option must not appear in combination with any of the fol‐
319              lowing options: no-flow-stats.  This option takes an integer
320              number as its argument.  The value of number is constrained to
321              being:
322                  greater than or equal to 0
323              The default number for this option is:
324                   0
325
326              This option will track and report flow expirations based on the
327              flow idle times. The timestamps within the pcap file are used to
328              determine the expiry, not the actual timestamp of the packets
329              are replayed. For example, a value of 30 suggests that if no
330              traffic is seen on a flow for 30 seconds, any subsequent traffic
331              would be considered a new flow, and thereby will increment the
332              flows and flows per second (fps) statistics.
333
334              This option can be used to optimize flow timeout settings for
335              flow products.  Setting the timeout low may lead to flows being
336              dropped when in fact the flow is simply slow to respond. Config‐
337              uring your flow timeouts too high may increase resources re‐
338              quired by your flow product.
339
340              Note that using this option while replaying at higher than orig‐
341              inal speeds can lead to inflated flows and fps counts.
342
343              Default is 0 (no expiry) and a typical value is 30-120 seconds.
344
345       -P, --pid
346              Print the PID of tcpreplay at startup.
347
348
349       --stats=number
350              Print statistics every X seconds, or every loop if '0'.  This
351              option takes an integer number as its argument.  The value of
352              number is constrained to being:
353                  greater than or equal to 0
354
355              Note that timed delays are a "best effort" and long delays be‐
356              tween sending packets may cause equally long delays between
357              printing statistics.
358
359       -V, --version
360              Print version information.
361
362
363       -h, --less-help
364              Display less usage information and exit.
365
366
367       -H, --help
368              Display usage information and exit.
369
370       -!, --more-help
371              Pass the extended usage information through a pager.
372
373       --save-opts [=cfgfile]
374              Save the option state to cfgfile.  The default is the last con‐
375              figuration file listed in the OPTION PRESETS section, below.
376              The command will exit after updating the config file.
377
378       --load-opts=cfgfile, --no-load-opts
379              Load options from cfgfile.  The no-load-opts form will disable
380              the loading of earlier config/rc/ini files.  --no-load-opts is
381              handled early, out of order.
382

OPTION PRESETS

384       Any option that is not marked as not presettable may be preset by load‐
385       ing values from configuration ("RC" or ".INI") file(s).  The homerc
386       file is "$$/", unless that is a directory.  In that case, the file
387       ".tcpreplayrc" is searched for within that directory.
388

FILES

390       See OPTION PRESETS for configuration files.
391

EXIT STATUS

393       One of the following exit values will be returned:
394
395       0  (EXIT_SUCCESS)
396              Successful program execution.
397
398       1  (EXIT_FAILURE)
399              The operation failed or the command syntax was not valid.
400
401       66  (EX_NOINPUT)
402              A specified configuration file could not be loaded.
403
404       70  (EX_SOFTWARE)
405              libopts had an internal operational error.  Please report it to
406              autogen-users@lists.sourceforge.net.  Thank you.
407

AUTHORS

409       Copyright 2013-2018 Fred Klassen - AppNeta Copyright 2000-2012 Aaron
410       Turner For support please use the tcpreplay-users@lists.sourceforge.net
411       mailing list.  The latest version of this software is always available
412       from: http://tcpreplay.appneta.com/
413
415       Copyright (C) 2000-2018 Aaron Turner and Fred Klassen all rights re‐
416       served.  This program is released under the terms of the GNU General
417       Public License, version 3 or later.
418

BUGS

420       Please send bug reports to: tcpreplay-users@lists.sourceforge.net
421

NOTES

423       This manual page was AutoGen-erated from the tcpreplay option defini‐
424       tions.
425
426
427
428tcpreplay                         01 May 2021                     tcpreplay(1)
Impressum