1TCPREPLAY(1) Programmer's Manual TCPREPLAY(1)
2
6 tcpreplay - Replay network traffic stored in pcap files
7
9 tcpreplay [-flag [value]]... [--opt-name [[=| ]value]]...
10 <pcap_file(s)>
11 tcpreplay is a tool for replaying network traffic from files saved with
13 tcpdump or other tools which write pcap(3) files.
14
16 This manual page briefly documents the tcpreplay command. The basic
17 operation of tcpreplay is to resend all packets from the input
18 file(s) at the speed at which they were recorded, or a specified data
19 rate, up to as fast as the hardware is capable.
20 Optionally, the traffic can be split between two interfaces, written to
22 files, filtered and edited in various ways, providing the means to test
23 firewalls, NIDS and other network devices.
24 For more details, please see the Tcpreplay Manual at: http://tcpre‐
26 play.synfin.net/trac/wiki/manual
27
29 -d number, --dbug=number
30 Enable debugging output. This option may appear up to 1 times.
31 This option takes an integer number as its argument. The value
32 of number is constrained to being:
33 in the range 0 through 5
34 The default number for this option is:
35 0
36 If configured with --enable-debug, then you can specify a ver‐
38 bosity level for debugging output. Higher numbers increase ver‐
39 bosity.
40 -q, --quiet
42 Quiet mode.
43 Print nothing except the statistics at the end of the run
45 -T string, --timer=string
47 Select packet timing mode: select, ioport, rdtsc, gtod, nano,
48 abstime. This option may appear up to 1 times. The default
49 string for this option is:
50 gtod
51 Allows you to select the packet timing method to use:
53 nano - Use nanosleep() API
55 select - Use select() API
57 ioport - Write to the i386 IO Port 0x80
59 rdtsc - Use the x86/x86_64/PPC RDTSC
61 gtod [default] - Use a gettimeofday() loop
63 abstime - Use OS X's AbsoluteTime API
65 --sleep-accel=number
68 Reduce the amount of time to sleep by specified usec. This
69 option takes an integer number as its argument. The default
70 number for this option is:
71 0
72 Reduce the amount of time we would normally sleep between two
74 packets by the specified number of usec. This provides a "fuzz
75 factor" to compensate for running on a non-RTOS and other pro‐
76 cesses using CPU time. Default is disabled.
77 --rdtsc-clicks=number
79 Specify the RDTSC clicks/usec. This option may appear up to 1
80 times. This option takes an integer number as its argument.
81 The default number for this option is:
82 0
83 Override the calculated number of RDTSC clicks/usec which is
85 often the speed of the CPU in Mhz. Only useful if you specified
86 --timer=rdtsc
87 -v, --verbose
89 Print decoded packets via tcpdump to STDOUT. This option may
90 appear up to 1 times.
91 -A string, --decode=string
95 Arguments passed to tcpdump decoder. This option may appear up
96 to 1 times. This option must appear in combination with the
97 following options: verbose.
98 When enabling verbose mode (-v) you may also specify one or more
100 additional arguments to pass to tcpdump to modify the way pack‐
101 ets are decoded. By default, -n and -l are used. Be sure to
102 quote the arguments like: -A "-axxx" so that they are not inter‐
103 preted by tcpreplay. Please see the tcpdump(1) man page for a
104 complete list of options.
105 -K, --enable-file-cache
107 Enable caching of packets to internal memory. This option must
108 appear in combination with the following options: loop.
109 Cache pcap file(s) the first time they are cached in RAM so that
111 subsequent loops don't incurr any disk I/O latency in order to
112 increase performance. Make sure you have enough free RAM to
113 store the entire pcap file(s) in memory or the system will swap
114 and performance will suffer.
115 --preload-pcap
117 Preloads packets into RAM before sending.
118 This option loads the specified pcap(s) into RAM before starting
120 to send in order to improve replay performance while introducing
121 a startup performance hit. Preloading can be used with or with‐
122 out --loop and implies --enable-file-cache.
123 -c string, --cachefile=string
125 Split traffic via a tcpprep cache file. This option may appear
126 up to 1 times.
127 -i string, --intf1=string
131 Server/primary traffic output interface. This option may appear
132 up to 1 times.
133 -I string, --intf2=string
137 Client/secondary traffic output interface. This option may
138 appear up to 1 times. This option must appear in combination
139 with the following options: cachefile.
140 --listnics
144 List available network interfaces and exit.
145 -l number, --loop=number
149 Loop through the capture file X times. This option may appear
150 up to 1 times. This option takes an integer number as its argu‐
151 ment. The value of number is constrained to being:
152 greater than or equal to 0
153 The default number for this option is:
154 1
155 --pktlen
159 Override the snaplen and use the actual packet len. This option
160 may appear up to 1 times.
161 By default, tcpreplay will send packets based on the size of the
163 "snaplen" stored in the pcap file which is usually the correct
164 thing to do. However, occasionally, tools will store more bytes
165 then told to. By specifying this option, tcpreplay will ignore
166 the snaplen field and instead try to send packets based on the
167 original packet length. Bad things may happen if you specify
168 this option.
169 -L number, --limit=number
171 Limit the number of packets to send. This option may appear up
172 to 1 times. This option takes an integer number as its argu‐
173 ment. The value of number is constrained to being:
174 greater than or equal to 1
175 The default number for this option is:
176 -1
177 By default, tcpreplay will send all the packets. Alternatively,
179 you can specify a maximum number of packets to send.
180 -x string, --multiplier=string
182 Modify replay speed to a given multiple. This option may appear
183 up to 1 times. This option must not appear in combination with
184 any of the following options: pps, mbps, oneatatime, topspeed.
185 Specify a floating point value to modify the packet replay
187 speed. Examples:
188 2.0 will replay traffic at twice the speed captured
189 0.7 will replay traffic at 70% the speed captured
190 -p number, --pps=number
192 Replay packets at a given packets/sec. This option may appear
193 up to 1 times. This option must not appear in combination with
194 any of the following options: multiplier, mbps, oneatatime, top‐
195 speed. This option takes an integer number as its argument.
196 -M string, --mbps=string
200 Replay packets at a given Mbps. This option may appear up to 1
201 times. This option must not appear in combination with any of
202 the following options: multiplier, pps, oneatatime, topspeed.
203 Specify a floating point value for the Mbps rate that tcpreplay
205 should send packets at.
206 -t, --topspeed
208 Replay packets as fast as possible. This option must not appear
209 in combination with any of the following options: mbps, multi‐
210 plier, pps, oneatatime.
211 -o, --oneatatime
215 Replay one packet at a time for each user input. This option
216 must not appear in combination with any of the following
217 options: mbps, pps, multiplier, topspeed.
218 Allows you to step through one or more packets at a time.
220 --pps-multi=number
222 Number of packets to send for each time interval. This option
223 must appear in combination with the following options: pps.
224 This option takes an integer number as its argument. The value
225 of number is constrained to being:
226 greater than or equal to 1
227 The default number for this option is:
228 1
229 When trying to send packets at very high rates, the time between
231 each packet can be so short that it is impossible to accurately
232 sleep for the required period of time. This option allows you
233 to send multiple packets at a time, thus allowing for longer
234 sleep times which can be more accurately implemented.
235 -P, --pid
237 Print the PID of tcpreplay at startup.
238 --stats=number
242 Print statistics every X seconds. This option takes an integer
243 number as its argument. The value of number is constrained to
244 being:
245 greater than or equal to 1
246 Note that this is very much a "best effort" and long delays
248 between sending packets may cause equally long delays between
249 printing statistics.
250 -V, --version
252 Print version information.
253 -h, --less-help
257 Display less usage information and exit.
258 -H, --help
262 Display usage information and exit.
263 -!, --more-help
265 Extended usage information passed thru pager.
266 - [rcfile], --save-opts[=rcfile]
268 Save the option state to rcfile. The default is the last con‐
269 figuration file listed in the OPTION PRESETS section, below.
270 - rcfile, --load-opts=rcfile, --no-load-opts
272 Load options from rcfile. The no-load-opts form will disable
273 the loading of earlier RC/INI files. --no-load-opts is handled
274 early, out of order.
275
277 Any option that is not marked as not presettable may be preset by load‐
278 ing values from configuration ("RC" or ".INI") file(s). The homerc
279 file is "$$/", unless that is a directory. In that case, the file
280 ".tcpreplayrc" is searched for within that directory.
281
283 tcpreplay understands the following signals:
284 SIGUSR1 Suspend tcpreplay
286 SIGCONT Restart tcpreplay
288
291 tcpreplay-edit(1), tcpdump(1), tcpprep(1), tcprewrite(1), libnet(3)
292
295 tcpreplay can only send packets as fast as your computer's interface,
296 processor, disk and system bus will allow.
297 Packet timing at high speeds is a black art and very OS/CPU dependent.
299 Replaying captured traffic may simulate odd or broken conditions on
301 your network and cause all sorts of problems.
302 In most cases, you can not replay traffic back to/at a server.
304 Some operating systems by default do not allow for forging source MAC
306 addresses. Please consult your operating system's documentation and
307 the tcpreplay FAQ if you experience this issue.
308
310 Copyright 2000-2010 Aaron Turner
311 For support please use the tcpreplay-users@lists.sourceforge.net mail‐
313 ing list.
314 The latest version of this software is always available from:
316 http://tcpreplay.synfin.net/
317 Released under the Free BSD License.
319 This manual page was AutoGen-erated from the tcpreplay option defini‐
321 tions.
322(tcpreplay ) 2010-04-04 TCPREPLAY(1)