1tcpreplay(1) User Commands tcpreplay(1)
2
6 tcpreplay - Replay network traffic stored in pcap files
7
9 tcpreplay [-flags] [-flag [value]] [--option-name[[=| ]value]]
10 <pcap_file(s)> | <pcap_dir(s)>
11 tcpreplay is a tool for replaying network traffic from files saved with
13 tcpdump or other tools which write pcap(3) files.
14
16 The basic operation of tcpreplay is to resend all packets from the
17 input file(s) at the speed at which they were recorded, or a specified
18 data rate, up to as fast as the hardware is capable.
19 Optionally, the traffic can be split between two interfaces, written to
21 files, filtered and edited in various ways, providing the means to test
22 firewalls, NIDS and other network devices.
23 For more details, please see the Tcpreplay Manual at: http://tcpre‐
25 play.appneta.com
26
28 -d number, --dbug=number
29 Enable debugging output. This option may appear up to 1 times.
30 This option takes an integer number as its argument. The value
31 of number is constrained to being:
32 in the range 0 through 5
33 The default number for this option is:
34 0
35 If configured with --enable-debug, then you can specify a ver‐
37 bosity level for debugging output. Higher numbers increase ver‐
38 bosity.
39 -q, --quiet
41 Quiet mode.
42 Print nothing except the statistics at the end of the run
44 -T string, --timer=string
46 Select packet timing mode: select, ioport, gtod, nano. This op‐
47 tion may appear up to 1 times. The default string for this op‐
48 tion is:
49 gtod
50 Allows you to select the packet timing method to use:
52 nano - Use nanosleep() API
54 select - Use select() API
56 ioport - Write to the i386 IO Port 0x80
58 gtod [default] - Use a gettimeofday() loop
60 --maxsleep=number
62 Sleep for no more then X milliseconds between packets. This op‐
63 tion takes an integer number as its argument. The default num‐
64 ber for this option is:
65 0
66 Set a limit for the maximum number of milliseconds that tcpre‐
68 play will sleep between packets. Effectively prevents long de‐
69 lays between packets without effecting the majority of packets.
70 Default is disabled.
71 -v, --verbose
73 Print decoded packets via tcpdump to STDOUT. This option may
74 appear up to 1 times.
75 -A string, --decode=string
78 Arguments passed to tcpdump decoder. This option may appear up
79 to 1 times. This option must appear in combination with the
80 following options: verbose.
81 When enabling verbose mode (-v) you may also specify one or more
83 additional arguments to pass to tcpdump to modify the way pack‐
84 ets are decoded. By default, -n and -l are used. Be sure to
85 quote the arguments like: -A "-axxx" so that they are not inter‐
86 preted by tcpreplay. Please see the tcpdump(1) man page for a
87 complete list of options.
88 -K, --preload-pcap
90 Preloads packets into RAM before sending.
91 This option loads the specified pcap(s) into RAM before starting
93 to send in order to improve replay performance while introducing
94 a startup performance hit. Preloading can be used with or with‐
95 out --loop. This option also suppresses flow statistics collec‐
96 tion for every iteration, which can significantly reduce memory
97 usage. Flow statistics are predicted based on options supplied
98 and statistics collected from the first loop iteration.
99 -c string, --cachefile=string
101 Split traffic via a tcpprep cache file. This option may appear
102 up to 1 times. This option must appear in combination with the
103 following options: intf2. This option must not appear in combi‐
104 nation with any of the following options: dualfile.
105 If you have a pcap file you would like to use to send bi-direc‐
107 tional traffic through a device (firewall, router, IDS, etc)
108 then using tcpprep you can create a cachefile which tcpreplay
109 will use to split the traffic across two network interfaces.
110 -2, --dualfile
112 Replay two files at a time from a network tap. This option may
113 appear up to 1 times. This option must appear in combination
114 with the following options: intf2. This option must not appear
115 in combination with any of the following options: cachefile.
116 If you captured network traffic using a network tap, then you
118 can end up with two pcap files- one for each direction. This
119 option will replay these two files at the same time, one on each
120 interface and inter-mix them using the timestamps in each.
121 -i string, --intf1=string
123 Client to server/RX/primary traffic output interface. This op‐
124 tion may appear up to 1 times.
125 Required network interface used to send either all traffic or
127 traffic which is marked as 'primary' via tcpprep. Primary traf‐
128 fic is usually client-to-server or inbound (RX) on khial virtual
129 interfaces.
130 -I string, --intf2=string
132 Server to client/TX/secondary traffic output interface. This
133 option may appear up to 1 times.
134 Optional network interface used to send traffic which is marked
136 as 'secondary' via tcpprep. Secondary traffic is usually
137 server-to-client or outbound (TX) on khial virtual interfaces.
138 Generally, it only makes sense to use this option with
139 --cachefile.
140 --listnics
142 List available network interfaces and exit.
143 -l number, --loop=number
146 Loop through the capture file X times. This option may appear
147 up to 1 times. This option takes an integer number as its argu‐
148 ment. The value of number is constrained to being:
149 greater than or equal to 0
150 The default number for this option is:
151 1
152 --loopdelay-ms=number
155 Delay between loops in milliseconds. This option must appear in
156 combination with the following options: loop. This option takes
157 an integer number as its argument. The value of number is con‐
158 strained to being:
159 greater than or equal to 0
160 The default number for this option is:
161 0
162 --pktlen
165 Override the snaplen and use the actual packet len. This option
166 may appear up to 1 times.
167 By default, tcpreplay will send packets based on the size of the
169 "snaplen" stored in the pcap file which is usually the correct
170 thing to do. However, occasionally, tools will store more bytes
171 then told to. By specifying this option, tcpreplay will ignore
172 the snaplen field and instead try to send packets based on the
173 original packet length. Bad things may happen if you specify
174 this option.
175 -L number, --limit=number
177 Limit the number of packets to send. This option may appear up
178 to 1 times. This option takes an integer number as its argu‐
179 ment. The value of number is constrained to being:
180 greater than or equal to 1
181 The default number for this option is:
182 -1
183 By default, tcpreplay will send all the packets. Alternatively,
185 you can specify a maximum number of packets to send.
186 --duration=number
188 Limit the number of seconds to send. This option may appear up
189 to 1 times. This option takes an integer number as its argu‐
190 ment. The value of number is constrained to being:
191 greater than or equal to 1
192 The default number for this option is:
193 -1
194 By default, tcpreplay will send all the packets. Alternatively,
196 you can specify a maximum number of seconds to transmit.
197 -x string, --multiplier=string
199 Modify replay speed to a given multiple. This option may appear
200 up to 1 times. This option must not appear in combination with
201 any of the following options: pps, mbps, oneatatime, topspeed.
202 Specify a value to modify the packet replay speed. Examples:
204 2.0 will replay traffic at twice the speed captured
205 0.7 will replay traffic at 70% the speed captured
206 -p string, --pps=string
208 Replay packets at a given packets/sec. This option may appear
209 up to 1 times. This option must not appear in combination with
210 any of the following options: multiplier, mbps, oneatatime, top‐
211 speed.
212 Specify a value to regulate the packet replay to a specific
214 packet-per-second rate. Examples:
215 200 will replay traffic at 200 packets per second
216 0.25 will replay traffic at 15 packets per minute
217 -M string, --mbps=string
219 Replay packets at a given Mbps. This option may appear up to 1
220 times. This option must not appear in combination with any of
221 the following options: multiplier, pps, oneatatime, topspeed.
222 Specify a floating point value for the Mbps rate that tcpreplay
224 should send packets at.
225 -t, --topspeed
227 Replay packets as fast as possible. This option must not appear
228 in combination with any of the following options: mbps, multi‐
229 plier, pps, oneatatime.
230 -o, --oneatatime
233 Replay one packet at a time for each user input. This option
234 must not appear in combination with any of the following op‐
235 tions: mbps, pps, multiplier, topspeed.
236 Allows you to step through one or more packets at a time.
238 --pps-multi=number
240 Number of packets to send for each time interval. This option
241 must appear in combination with the following options: pps.
242 This option takes an integer number as its argument. The value
243 of number is constrained to being:
244 greater than or equal to 1
245 The default number for this option is:
246 1
247 When trying to send packets at very high rates, the time between
249 each packet can be so short that it is impossible to accurately
250 sleep for the required period of time. This option allows you
251 to send multiple packets at a time, thus allowing for longer
252 sleep times which can be more accurately implemented.
253 --unique-ip
255 Modify IP addresses each loop iteration to generate unique
256 flows. This option must appear in combination with the follow‐
257 ing options: loop.
258 Ensure IPv4 and IPv6 packets will be unique for each --loop it‐
260 eration. This is done in a way that will not alter packet CRC,
261 and therefore will generally not affect performance. This option
262 will significantly increase the flows/sec over generated over
263 multiple loop iterations.
264 --unique-ip-loops=string
266 Number of times to loop before assigning new unique ip. This
267 option may appear up to 1 times. This option must appear in
268 combination with the following options: unique-ip.
269 Number of --loop iterations before a new unique IP is assigned.
271 Default is 1. Assumes both --loop and --unique-ip.
272 --netmap
274 Write packets directly to netmap enabled network adapter.
275 This feature will detect netmap capable network drivers on Linux
277 and BSD systems. If detected, the network driver is bypassed for
278 the execution duration, and network buffers will be written to
279 directly. This will allow you to achieve full line rates on com‐
280 modity network adapters, similar to rates achieved by commercial
281 network traffic generators. Note that bypassing the network
282 driver will disrupt other applications connected through the
283 test interface. See INSTALL for more information.
284 This feature can also be enabled by specifying an interface as
286 'netmap:<intf>' or 'vale:<intf>. For example 'netmap:eth0' spec‐
287 ifies netmap over interface eth0.
288 --nm-delay=number
290 Netmap startup delay. This option takes an integer number as
291 its argument. The default number for this option is:
292 10
293 Number of seconds to delay after netmap is loaded. Required to
295 ensure interfaces are fully up before netmap transmit. Requires
296 netmap option. Default is 10 seconds.
297 --no-flow-stats
299 Suppress printing and tracking flow count, rates and expira‐
300 tions.
301 Suppress the collection and printing of flow statistics. This
303 option may improve performance when not using --preload-pcap op‐
304 tion, otherwise its only function is to suppress printing.
305 The flow feature will track and print statistics of the flows
307 being sent. A flow is loosely defined as a unique combination
308 of a 5-tuple, i.e. source IP, destination IP, source port, des‐
309 tination port and protocol.
310 If --loop is specified, the flows from one iteration to the next
312 will not be unique, unless the packets are altered. Use
313 --unique-ip or tcpreplay-edit to alter packets between itera‐
314 tions.
315 --flow-expiry=number
317 Number of inactive seconds before a flow is considered expired.
318 This option must not appear in combination with any of the fol‐
319 lowing options: no-flow-stats. This option takes an integer
320 number as its argument. The value of number is constrained to
321 being:
322 greater than or equal to 0
323 The default number for this option is:
324 0
325 This option will track and report flow expirations based on the
327 flow idle times. The timestamps within the pcap file are used to
328 determine the expiry, not the actual timestamp of the packets
329 are replayed. For example, a value of 30 suggests that if no
330 traffic is seen on a flow for 30 seconds, any subsequent traffic
331 would be considered a new flow, and thereby will increment the
332 flows and flows per second (fps) statistics.
333 This option can be used to optimize flow timeout settings for
335 flow products. Setting the timeout low may lead to flows being
336 dropped when in fact the flow is simply slow to respond. Config‐
337 uring your flow timeouts too high may increase resources re‐
338 quired by your flow product.
339 Note that using this option while replaying at higher than orig‐
341 inal speeds can lead to inflated flows and fps counts.
342 Default is 0 (no expiry) and a typical value is 30-120 seconds.
344 -P, --pid
346 Print the PID of tcpreplay at startup.
347 --stats=number
350 Print statistics every X seconds, or every loop if '0'. This
351 option takes an integer number as its argument. The value of
352 number is constrained to being:
353 greater than or equal to 0
354 Note that timed delays are a "best effort" and long delays be‐
356 tween sending packets may cause equally long delays between
357 printing statistics.
358 -V, --version
360 Print version information.
361 -h, --less-help
364 Display less usage information and exit.
365 -H, --help
368 Display usage information and exit.
369 -!, --more-help
371 Pass the extended usage information through a pager.
372 --save-opts [=cfgfile]
374 Save the option state to cfgfile. The default is the last con‐
375 figuration file listed in the OPTION PRESETS section, below.
376 The command will exit after updating the config file.
377 --load-opts=cfgfile, --no-load-opts
379 Load options from cfgfile. The no-load-opts form will disable
380 the loading of earlier config/rc/ini files. --no-load-opts is
381 handled early, out of order.
382
384 Any option that is not marked as not presettable may be preset by load‐
385 ing values from configuration ("RC" or ".INI") file(s). The homerc
386 file is "$$/", unless that is a directory. In that case, the file
387 ".tcpreplayrc" is searched for within that directory.
388
390 See OPTION PRESETS for configuration files.
391
393 One of the following exit values will be returned:
394 0 (EXIT_SUCCESS)
396 Successful program execution.
397 1 (EXIT_FAILURE)
399 The operation failed or the command syntax was not valid.
400 66 (EX_NOINPUT)
402 A specified configuration file could not be loaded.
403 70 (EX_SOFTWARE)
405 libopts had an internal operational error. Please report it to
406 autogen-users@lists.sourceforge.net. Thank you.
407
409 Copyright 2013-2022 Fred Klassen - AppNeta Copyright 2000-2012 Aaron
410 Turner For support please use the tcpreplay-users@lists.sourceforge.net
411 mailing list. The latest version of this software is always available
412 from: http://tcpreplay.appneta.com/
413
415 Copyright (C) 2000-2022 Aaron Turner and Fred Klassen all rights re‐
416 served. This program is released under the terms of the GNU General
417 Public License, version 3 or later.
418
420 Please send bug reports to: tcpreplay-users@lists.sourceforge.net
421
423 This manual page was AutoGen-erated from the tcpreplay option defini‐
424 tions.
425tcpreplay 12 Feb 2022 tcpreplay(1)