1tcpreplay-edit(1) User Commands tcpreplay-edit(1)
2
6 tcpreplay-edit - Replay network traffic stored in pcap files
7
9 tcpreplay-edit [-flags] [-flag [value]] [--option-name[[=| ]value]]
10 <pcap_file(s)> | <pcap_dir(s)>
11 tcpreplay is a tool for replaying network traffic from files saved with
13 tcpdump or other tools which write pcap(3) files.
14
16 The basic operation of tcpreplay is to resend all packets from the
17 input file(s) at the speed at which they were recorded, or a specified
18 data rate, up to as fast as the hardware is capable.
19 Optionally, the traffic can be split between two interfaces, written to
21 files, filtered and edited in various ways, providing the means to test
22 firewalls, NIDS and other network devices.
23 For more details, please see the Tcpreplay Manual at: http://tcpre‐
25 play.appneta.com
26
28 -r string, --portmap=string
30 Rewrite TCP/UDP ports. This option may appear up to 9999 times.
31 Specify a list of comma delimited port mappings consisting of
33 colon delimited port number pairs. Each colon delimited port
34 pair consists of the port to match followed by the port number
35 to rewrite.
36 Examples:
38 --portmap=80:8000 --portmap=8080:80 # 80->8000 and 8080->80
39 --portmap=8000,8080,88888:80 # 3 different ports become 80
40 --portmap=8000-8999:80 # ports 8000 to 8999 become 80
41 -s number, --seed=number
43 Randomize src/dst IPv4/v6 addresses w/ given seed. This option
44 may appear up to 1 times. This option must not appear in combi‐
45 nation with any of the following options: fuzz-seed. This op‐
46 tion takes an integer number as its argument.
47 Causes the source and destination IPv4/v6 addresses to be pseudo
49 randomized but still maintain client/server relationships.
50 Since the randomization is deterministic based on the seed, you
51 can reuse the same seed value to recreate the traffic.
52 -N string, --pnat=string
54 Rewrite IPv4/v6 addresses using pseudo-NAT. This option may ap‐
55 pear up to 2 times. This option must not appear in combination
56 with any of the following options: srcipmap.
57 Takes a comma delimited series of colon delimited CIDR netblock
59 pairs. Each netblock pair is evaluated in order against the IP
60 addresses. If the IP address in the packet matches the first
61 netblock, it is rewritten using the second netblock as a mask
62 against the high order bits.
63 IPv4 Example:
65 --pnat=192.168.0.0/16:10.77.0.0/16,172.16.0.0/12:10.1.0.0/24
66 IPv6 Example:
67 --pnat=[2001:db8::/32]:[dead::/16],[2001:db8::/32]:[::ffff:0:0/96]
68 -S string, --srcipmap=string
70 Rewrite source IPv4/v6 addresses using pseudo-NAT. This option
71 may appear up to 1 times. This option must not appear in combi‐
72 nation with any of the following options: pnat.
73 Works just like the --pnat option, but only affects the source
75 IP addresses in the IPv4/v6 header.
76 -D string, --dstipmap=string
78 Rewrite destination IPv4/v6 addresses using pseudo-NAT. This
79 option may appear up to 1 times. This option must not appear in
80 combination with any of the following options: pnat.
81 Works just like the --pnat option, but only affects the destina‐
83 tion IP addresses in the IPv4/v6 header.
84 -e string, --endpoints=string
86 Rewrite IP addresses to be between two endpoints. This option
87 may appear up to 1 times. This option must appear in combina‐
88 tion with the following options: cachefile.
89 Takes a pair of colon delimited IPv4/v6 addresses which will be
91 used to rewrite all traffic to appear to be between the two IP
92 addresses.
93 IPv4 Example:
95 --endpoints=172.16.0.1:172.16.0.2
96 IPv6 Example:
97 --endpoints=[2001:db8::dead:beef]:[::ffff:0:0:ac:f:0:2]
98 --tcp-sequence=number
100 Change TCP Sequence (and ACK) numbers /w given seed. This op‐
101 tion takes an integer number as its argument. The value of num‐
102 ber is constrained to being:
103 greater than or equal to 1
104 The default number for this option is:
105 0
106 Change all TCP sequence numbers, and related sequence-acknowl‐
108 edgement numbers. They will be shifted by a random amount based
109 on the provided seed.
110 -b, --skipbroadcast
112 Skip rewriting broadcast/multicast IPv4/v6 addresses.
113 By default --seed, --pnat and --endpoints will rewrite broadcast
115 and multicast IPv4/v6 and MAC addresses. Setting this flag will
116 keep broadcast/multicast IPv4/v6 and MAC addresses from being
117 rewritten.
118 -C, --fixcsum
120 Force recalculation of IPv4/TCP/UDP header checksums.
121 Causes each IPv4/v6 packet to have their checksums recalculated
123 and fixed. Automatically enabled for packets modified with
124 --seed, --pnat, --endpoints or --fixlen.
125 -m number, --mtu=number
127 Override default MTU length (1500 bytes). This option may ap‐
128 pear up to 1 times. This option takes an integer number as its
129 argument. The value of number is constrained to being:
130 in the range 1 through MAX_SNAPLEN
131 Override the default 1500 byte MTU size for determining the max‐
133 imum padding length (--fixlen=pad) or when truncating (--mtu-
134 trunc).
135 --mtu-trunc
137 Truncate packets larger then specified MTU. This option may ap‐
138 pear up to 1 times.
139 Similar to --fixlen, this option will truncate data in packets
141 from Layer 3 and above to be no larger then the MTU.
142 -E, --efcs
144 Remove Ethernet checksums (FCS) from end of frames.
145 Note, this option is pretty dangerous! We do not actually check
147 to see if a FCS actually exists in the frame, we just blindly
148 delete the last 4 bytes. Hence, you should only use this if you
149 know know that your OS provides the FCS when reading raw pack‐
150 ets.
151 --ttl=string
153 Modify the IPv4/v6 TTL/Hop Limit.
154 Allows you to modify the TTL/Hop Limit of all the IPv4/v6 pack‐
156 ets. Specify a number to hard-code the value or +/-value to in‐
157 crease or decrease by the value provided (limited to 1-255).
158 Examples:
160 --ttl=10
161 --ttl=+7
162 --ttl=-64
163 --tos=number
165 Set the IPv4 TOS/DiffServ/ECN byte. This option may appear up
166 to 1 times. This option takes an integer number as its argu‐
167 ment. The value of number is constrained to being:
168 in the range 0 through 255
169 Allows you to override the TOS (also known as DiffServ/ECN)
171 value in IPv4.
172 --tclass=number
174 Set the IPv6 Traffic Class byte. This option may appear up to 1
175 times. This option takes an integer number as its argument.
176 The value of number is constrained to being:
177 in the range 0 through 255
178 Allows you to override the IPv6 Traffic Class field.
180 --flowlabel=number
182 Set the IPv6 Flow Label. This option may appear up to 1 times.
183 This option takes an integer number as its argument. The value
184 of number is constrained to being:
185 in the range 0 through 1048575
186 Allows you to override the 20bit IPv6 Flow Label field. Has no
188 effect on IPv4 packets.
189 -F string, --fixlen=string
191 Pad or truncate packet data to match header length. This option
192 may appear up to 1 times.
193 Packets may be truncated during capture if the snaplen is
195 smaller then the packet. This option allows you to modify the
196 packet to pad the packet back out to the size stored in the
197 IPv4/v6 header or rewrite the IP header total length to reflect
198 the stored packet length.
199 pad Truncated packets will be padded out so that the packet
201 length matches the IPv4 total length
202 trunc Truncated packets will have their IPv4 total length field
204 rewritten to match the actual packet length
205 del Delete the packet
207 --fuzz-seed=number
209 Fuzz 1 in X packets. Edit bytes, length, or emulate packet drop.
210 This option takes an integer number as its argument. The value
211 of number is constrained to being:
212 greater than or equal to 0
213 The default number for this option is:
214 0
215 This fuzzing was designed as to test layer 7 protocols such as
217 voip protocols. It modifies randomly 1 out of X packets (where
218 X = --fuzz-factor) in order for stateful protocols to cover more
219 of their code. The random fuzzing actions focus on data start
220 and end because it often is the part of the data application
221 protocols base their decisions on.
222 Possible fuzzing actions list:
224 * drop packet
225 * reduce packet size
226 * edit packet Bytes:
227 * Not all Bytes have the same probability of appearance in
228 real life.
229 Replace with 0x00, 0xFF, or a random byte with equal like‐
230 lihood.
231 * Not all Bytes have the same significance in a packet.
232 Replace the start, the end, or the middle of the packet
233 with equal likelihood.
234 * do nothing (7 out of 8 packets)
235 --fuzz-factor=number
237 Set the Fuzz 1 in X packet ratio (default 1 in 8 packets). This
238 option must appear in combination with the following options:
239 fuzz-seed. This option takes an integer number as its argument.
240 The value of number is constrained to being:
241 greater than or equal to 1
242 The default number for this option is:
243 8
244 Sets the ratio of for --fuzz-seed option. By default this value
246 is 8, which means 1 in 8 packets are modified by fuzzing. Note
247 that this ratio is based on the random number generated by the
248 supplied fuzz seed. Therefore by default you cannot expect that
249 exactly every eighth packet will be modified.
250 --skipl2broadcast
252 Skip rewriting broadcast/multicast Layer 2 addresses.
253 By default, editing Layer 2 addresses will rewrite broadcast and
255 multicast MAC addresses. Setting this flag will keep broad‐
256 cast/multicast MAC addresses from being rewritten.
257 --dlt=string
259 Override output DLT encapsulation. This option may appear up to
260 1 times.
261 By default, no DLT (data link type) conversion will be made. To
263 change the DLT type of the output pcap, select one of the fol‐
264 lowing values:
265 enet Ethernet aka DLT_EN10MB
267 hdlc Cisco HDLC aka DLT_C_HDLC
269 jnpr_eth Juniper Ethernet DLT_C_JNPR_ETHER
271 pppserial PPP Serial aka DLT_PPP_SERIAL
273 user User specified Layer 2 header and DLT type
275 --enet-dmac=string
277 Override destination ethernet MAC addresses. This option may
278 appear up to 1 times.
279 Takes a pair of comma deliminated ethernet MAC addresses which
281 will replace the destination MAC address of outbound packets.
282 The first MAC address will be used for the server to client
283 traffic and the optional second MAC address will be used for the
284 client to server traffic.
285 Example:
287 --enet-dmac=00:12:13:14:15:16,00:22:33:44:55:66
288 --enet-smac=string
290 Override source ethernet MAC addresses. This option may appear
291 up to 1 times.
292 Takes a pair of comma deliminated ethernet MAC addresses which
294 will replace the source MAC address of outbound packets. The
295 first MAC address will be used for the server to client traffic
296 and the optional second MAC address will be used for the client
297 to server traffic.
298 Example:
300 --enet-smac=00:12:13:14:15:16,00:22:33:44:55:66
301 --enet-subsmac=string
303 Substitute MAC addresses. This option may appear up to 9999
304 times.
305 Allows you to rewrite ethernet MAC addresses of packets. It
307 takes comma delimited pair or MACs address and rewrites all oc‐
308 currences of the first MAC with the value of the second MAC.
309 Example:
310 --enet-subsmac=00:12:13:14:15:16,00:22:33:44:55:66
311 --enet-mac-seed=number
313 Randomize MAC addresses. This option may appear up to 1 times.
314 This option must not appear in combination with any of the fol‐
315 lowing options: enet-smac, enet-dmac, enet-subsmac. This option
316 takes an integer number as its argument.
317 Allows you to randomize ethernet MAC addresses of packets,
319 mostly like what --seed option does for IPv4/IPv6 addresses.
320 --enet-mac-seed-keep-bytes=number
322 Randomize MAC addresses. This option may appear up to 1 times.
323 This option must appear in combination with the following op‐
324 tions: enet-mac-seed. This option takes an integer number as
325 its argument. The value of number is constrained to being:
326 in the range 1 through 6
327 Keep some bytes untouched when usinging --enet-mac-seed option.
329 --enet-vlan=string
331 Specify ethernet 802.1q VLAN tag mode. This option may appear
332 up to 1 times.
333 Allows you to rewrite ethernet frames to add a 802.1q header to
335 standard 802.3 ethernet headers or remove the 802.1q VLAN tag
336 information.
337 add Adds an 802.1q VLAN header to the existing 802.3 ethernet
339 header. If a VLAN header already exists, a new VLAN header is
340 added outside of the existing header.
341 Note that you will be allowed to run this option multiple times
343 to create more than 2 VLAN headers, however those packets will
344 be valid. At most you should have 2 X 802.1q VLAN tags, or outer
345 an 802.1ad and an inner 802.1q VLAN tag.
346 del Rewrites the existing 802.1q VLAN header as an 802.3 ether‐
348 net header
349 --enet-vlan-tag=number
351 Specify the new ethernet 802.1q VLAN tag value. This option may
352 appear up to 1 times. This option must appear in combination
353 with the following options: enet-vlan. This option takes an in‐
354 teger number as its argument. The value of number is con‐
355 strained to being:
356 in the range 0 through 4095
357 --enet-vlan-cfi=number
360 Specify the ethernet 802.1q VLAN CFI value. This option may ap‐
361 pear up to 1 times. This option must appear in combination with
362 the following options: enet-vlan. This option takes an integer
363 number as its argument. The value of number is constrained to
364 being:
365 in the range 0 through 1
366 --enet-vlan-pri=number
369 Specify the ethernet 802.1q VLAN priority. This option may ap‐
370 pear up to 1 times. This option must appear in combination with
371 the following options: enet-vlan. This option takes an integer
372 number as its argument. The value of number is constrained to
373 being:
374 in the range 0 through 7
375 --enet-vlan-proto=string
378 Specify VLAN tag protocol 802.1q or 802.1ad. This option may
379 appear up to 1 times.
380 Allows you to specify the protocol of the added VLAN tags.
382 802.1q Specifies that 802.1q VLAN headers are to be added. This
384 is the default.
385 802.1ad Specifies that 802.1ad Q-in-Q VLAN headers are to be
387 added. To make valid packets, input packets must already have
388 802.1q VLAN headers.
389 --hdlc-control=number
391 Specify HDLC control value. This option may appear up to 1
392 times. This option takes an integer number as its argument.
393 The Cisco HDLC header has a 1 byte "control" field. Apparently
395 this should always be 0, but if you can use any 1 byte value.
396 --hdlc-address=number
398 Specify HDLC address. This option may appear up to 1 times.
399 This option takes an integer number as its argument.
400 The Cisco HDLC header has a 1 byte "address" field which has two
402 valid values:
403 0x0F Unicast
405 0xBF Broadcast
407 You can however specify any single byte value.
408 --user-dlt=number
410 Set output file DLT type. This option may appear up to 1 times.
411 This option takes an integer number as its argument.
412 Set the DLT value of the output pcap file.
414 --user-dlink=string
416 Rewrite Data-Link layer with user specified data. This option
417 may appear up to 2 times.
418 Provide a series of comma deliminated hex values which will be
420 used to rewrite or create the Layer 2 header of the packets.
421 The first instance of this argument will rewrite both server and
422 client traffic, but if this argument is specified a second time,
423 it will be used for the client traffic.
424 Example:
426 --user-dlink=01,02,03,04,05,06,00,1A,2B,3C,4D,5E,6F,08,00
427 -d number, --dbug=number
429 Enable debugging output. This option may appear up to 1 times.
430 This option takes an integer number as its argument. The value
431 of number is constrained to being:
432 in the range 0 through 5
433 The default number for this option is:
434 0
435 If configured with --enable-debug, then you can specify a ver‐
437 bosity level for debugging output. Higher numbers increase ver‐
438 bosity.
439 -q, --quiet
441 Quiet mode.
442 Print nothing except the statistics at the end of the run
444 -T string, --timer=string
446 Select packet timing mode: select, ioport, gtod, nano. This op‐
447 tion may appear up to 1 times. The default string for this op‐
448 tion is:
449 gtod
450 Allows you to select the packet timing method to use:
452 nano - Use nanosleep() API
454 select - Use select() API
456 ioport - Write to the i386 IO Port 0x80
458 gtod [default] - Use a gettimeofday() loop
460 --maxsleep=number
462 Sleep for no more then X milliseconds between packets. This op‐
463 tion takes an integer number as its argument. The default num‐
464 ber for this option is:
465 0
466 Set a limit for the maximum number of milliseconds that tcpre‐
468 play will sleep between packets. Effectively prevents long de‐
469 lays between packets without effecting the majority of packets.
470 Default is disabled.
471 -v, --verbose
473 Print decoded packets via tcpdump to STDOUT. This option may
474 appear up to 1 times.
475 -A string, --decode=string
478 Arguments passed to tcpdump decoder. This option may appear up
479 to 1 times. This option must appear in combination with the
480 following options: verbose.
481 When enabling verbose mode (-v) you may also specify one or more
483 additional arguments to pass to tcpdump to modify the way pack‐
484 ets are decoded. By default, -n and -l are used. Be sure to
485 quote the arguments like: -A "-axxx" so that they are not inter‐
486 preted by tcpreplay. Please see the tcpdump(1) man page for a
487 complete list of options.
488 -K, --preload-pcap
490 Preloads packets into RAM before sending.
491 This option loads the specified pcap(s) into RAM before starting
493 to send in order to improve replay performance while introducing
494 a startup performance hit. Preloading can be used with or with‐
495 out --loop. This option also suppresses flow statistics collec‐
496 tion for every iteration, which can significantly reduce memory
497 usage. Flow statistics are predicted based on options supplied
498 and statistics collected from the first loop iteration.
499 -c string, --cachefile=string
501 Split traffic via a tcpprep cache file. This option may appear
502 up to 1 times. This option must appear in combination with the
503 following options: intf2. This option must not appear in combi‐
504 nation with any of the following options: dualfile.
505 If you have a pcap file you would like to use to send bi-direc‐
507 tional traffic through a device (firewall, router, IDS, etc)
508 then using tcpprep you can create a cachefile which tcpreplay
509 will use to split the traffic across two network interfaces.
510 -2, --dualfile
512 Replay two files at a time from a network tap. This option may
513 appear up to 1 times. This option must appear in combination
514 with the following options: intf2. This option must not appear
515 in combination with any of the following options: cachefile.
516 If you captured network traffic using a network tap, then you
518 can end up with two pcap files- one for each direction. This
519 option will replay these two files at the same time, one on each
520 interface and inter-mix them using the timestamps in each.
521 -i string, --intf1=string
523 Client to server/RX/primary traffic output interface. This op‐
524 tion may appear up to 1 times.
525 Required network interface used to send either all traffic or
527 traffic which is marked as 'primary' via tcpprep. Primary traf‐
528 fic is usually client-to-server or inbound (RX) on khial virtual
529 interfaces.
530 -I string, --intf2=string
532 Server to client/TX/secondary traffic output interface. This
533 option may appear up to 1 times.
534 Optional network interface used to send traffic which is marked
536 as 'secondary' via tcpprep. Secondary traffic is usually
537 server-to-client or outbound (TX) on khial virtual interfaces.
538 Generally, it only makes sense to use this option with
539 --cachefile.
540 --listnics
542 List available network interfaces and exit.
543 -l number, --loop=number
546 Loop through the capture file X times. This option may appear
547 up to 1 times. This option takes an integer number as its argu‐
548 ment. The value of number is constrained to being:
549 greater than or equal to 0
550 The default number for this option is:
551 1
552 --loopdelay-ms=number
555 Delay between loops in milliseconds. This option must appear in
556 combination with the following options: loop. This option takes
557 an integer number as its argument. The value of number is con‐
558 strained to being:
559 greater than or equal to 0
560 The default number for this option is:
561 0
562 --pktlen
565 Override the snaplen and use the actual packet len. This option
566 may appear up to 1 times.
567 By default, tcpreplay will send packets based on the size of the
569 "snaplen" stored in the pcap file which is usually the correct
570 thing to do. However, occasionally, tools will store more bytes
571 then told to. By specifying this option, tcpreplay will ignore
572 the snaplen field and instead try to send packets based on the
573 original packet length. Bad things may happen if you specify
574 this option.
575 -L number, --limit=number
577 Limit the number of packets to send. This option may appear up
578 to 1 times. This option takes an integer number as its argu‐
579 ment. The value of number is constrained to being:
580 greater than or equal to 1
581 The default number for this option is:
582 -1
583 By default, tcpreplay will send all the packets. Alternatively,
585 you can specify a maximum number of packets to send.
586 --duration=number
588 Limit the number of seconds to send. This option may appear up
589 to 1 times. This option takes an integer number as its argu‐
590 ment. The value of number is constrained to being:
591 greater than or equal to 1
592 The default number for this option is:
593 -1
594 By default, tcpreplay will send all the packets. Alternatively,
596 you can specify a maximum number of seconds to transmit.
597 -x string, --multiplier=string
599 Modify replay speed to a given multiple. This option may appear
600 up to 1 times. This option must not appear in combination with
601 any of the following options: pps, mbps, oneatatime, topspeed.
602 Specify a value to modify the packet replay speed. Examples:
604 2.0 will replay traffic at twice the speed captured
605 0.7 will replay traffic at 70% the speed captured
606 -p string, --pps=string
608 Replay packets at a given packets/sec. This option may appear
609 up to 1 times. This option must not appear in combination with
610 any of the following options: multiplier, mbps, oneatatime, top‐
611 speed.
612 Specify a value to regulate the packet replay to a specific
614 packet-per-second rate. Examples:
615 200 will replay traffic at 200 packets per second
616 0.25 will replay traffic at 15 packets per minute
617 -M string, --mbps=string
619 Replay packets at a given Mbps. This option may appear up to 1
620 times. This option must not appear in combination with any of
621 the following options: multiplier, pps, oneatatime, topspeed.
622 Specify a floating point value for the Mbps rate that tcpreplay
624 should send packets at.
625 -t, --topspeed
627 Replay packets as fast as possible. This option must not appear
628 in combination with any of the following options: mbps, multi‐
629 plier, pps, oneatatime.
630 -o, --oneatatime
633 Replay one packet at a time for each user input. This option
634 must not appear in combination with any of the following op‐
635 tions: mbps, pps, multiplier, topspeed.
636 Allows you to step through one or more packets at a time.
638 --pps-multi=number
640 Number of packets to send for each time interval. This option
641 must appear in combination with the following options: pps.
642 This option takes an integer number as its argument. The value
643 of number is constrained to being:
644 greater than or equal to 1
645 The default number for this option is:
646 1
647 When trying to send packets at very high rates, the time between
649 each packet can be so short that it is impossible to accurately
650 sleep for the required period of time. This option allows you
651 to send multiple packets at a time, thus allowing for longer
652 sleep times which can be more accurately implemented.
653 --unique-ip
655 Modify IP addresses each loop iteration to generate unique
656 flows. This option must appear in combination with the follow‐
657 ing options: loop. This option must not appear in combination
658 with any of the following options: seed, fuzz-seed.
659 Ensure IPv4 and IPv6 packets will be unique for each --loop it‐
661 eration. This is done in a way that will not alter packet CRC,
662 and therefore will generally not affect performance. This option
663 will significantly increase the flows/sec over generated over
664 multiple loop iterations.
665 --unique-ip-loops=string
667 Number of times to loop before assigning new unique ip. This
668 option may appear up to 1 times. This option must appear in
669 combination with the following options: unique-ip.
670 Number of --loop iterations before a new unique IP is assigned.
672 Default is 1. Assumes both --loop and --unique-ip.
673 --netmap
675 Write packets directly to netmap enabled network adapter.
676 This feature will detect netmap capable network drivers on Linux
678 and BSD systems. If detected, the network driver is bypassed for
679 the execution duration, and network buffers will be written to
680 directly. This will allow you to achieve full line rates on com‐
681 modity network adapters, similar to rates achieved by commercial
682 network traffic generators. Note that bypassing the network
683 driver will disrupt other applications connected through the
684 test interface. See INSTALL for more information.
685 This feature can also be enabled by specifying an interface as
687 'netmap:<intf>' or 'vale:<intf>. For example 'netmap:eth0' spec‐
688 ifies netmap over interface eth0.
689 --nm-delay=number
691 Netmap startup delay. This option takes an integer number as
692 its argument. The default number for this option is:
693 10
694 Number of seconds to delay after netmap is loaded. Required to
696 ensure interfaces are fully up before netmap transmit. Requires
697 netmap option. Default is 10 seconds.
698 --no-flow-stats
700 Suppress printing and tracking flow count, rates and expira‐
701 tions.
702 Suppress the collection and printing of flow statistics. This
704 option may improve performance when not using --preload-pcap op‐
705 tion, otherwise its only function is to suppress printing.
706 The flow feature will track and print statistics of the flows
708 being sent. A flow is loosely defined as a unique combination
709 of a 5-tuple, i.e. source IP, destination IP, source port, des‐
710 tination port and protocol.
711 If --loop is specified, the flows from one iteration to the next
713 will not be unique, unless the packets are altered. Use
714 --unique-ip or tcpreplay-edit to alter packets between itera‐
715 tions.
716 --flow-expiry=number
718 Number of inactive seconds before a flow is considered expired.
719 This option must not appear in combination with any of the fol‐
720 lowing options: no-flow-stats. This option takes an integer
721 number as its argument. The value of number is constrained to
722 being:
723 greater than or equal to 0
724 The default number for this option is:
725 0
726 This option will track and report flow expirations based on the
728 flow idle times. The timestamps within the pcap file are used to
729 determine the expiry, not the actual timestamp of the packets
730 are replayed. For example, a value of 30 suggests that if no
731 traffic is seen on a flow for 30 seconds, any subsequent traffic
732 would be considered a new flow, and thereby will increment the
733 flows and flows per second (fps) statistics.
734 This option can be used to optimize flow timeout settings for
736 flow products. Setting the timeout low may lead to flows being
737 dropped when in fact the flow is simply slow to respond. Config‐
738 uring your flow timeouts too high may increase resources re‐
739 quired by your flow product.
740 Note that using this option while replaying at higher than orig‐
742 inal speeds can lead to inflated flows and fps counts.
743 Default is 0 (no expiry) and a typical value is 30-120 seconds.
745 -P, --pid
747 Print the PID of tcpreplay at startup.
748 --stats=number
751 Print statistics every X seconds, or every loop if '0'. This
752 option takes an integer number as its argument. The value of
753 number is constrained to being:
754 greater than or equal to 0
755 Note that timed delays are a "best effort" and long delays be‐
757 tween sending packets may cause equally long delays between
758 printing statistics.
759 -V, --version
761 Print version information.
762 -h, --less-help
765 Display less usage information and exit.
766 -H, --help
769 Display usage information and exit.
770 -!, --more-help
772 Pass the extended usage information through a pager.
773 --save-opts [=cfgfile]
775 Save the option state to cfgfile. The default is the last con‐
776 figuration file listed in the OPTION PRESETS section, below.
777 The command will exit after updating the config file.
778 --load-opts=cfgfile, --no-load-opts
780 Load options from cfgfile. The no-load-opts form will disable
781 the loading of earlier config/rc/ini files. --no-load-opts is
782 handled early, out of order.
783
785 Any option that is not marked as not presettable may be preset by load‐
786 ing values from configuration ("RC" or ".INI") file(s). The homerc
787 file is "$$/", unless that is a directory. In that case, the file
788 ".tcpreplay-editrc" is searched for within that directory.
789
791 See OPTION PRESETS for configuration files.
792
794 One of the following exit values will be returned:
795 0 (EXIT_SUCCESS)
797 Successful program execution.
798 1 (EXIT_FAILURE)
800 The operation failed or the command syntax was not valid.
801 66 (EX_NOINPUT)
803 A specified configuration file could not be loaded.
804 70 (EX_SOFTWARE)
806 libopts had an internal operational error. Please report it to
807 autogen-users@lists.sourceforge.net. Thank you.
808
810 Copyright 2013-2022 Fred Klassen - AppNeta Copyright 2000-2012 Aaron
811 Turner For support please use the tcpreplay-users@lists.sourceforge.net
812 mailing list. The latest version of this software is always available
813 from: http://tcpreplay.appneta.com/
814
816 Copyright (C) 2000-2022 Aaron Turner and Fred Klassen all rights re‐
817 served. This program is released under the terms of the GNU General
818 Public License, version 3 or later.
819
821 Please send bug reports to: tcpreplay-users@lists.sourceforge.net
822
824 This manual page was AutoGen-erated from the tcpreplay-edit option def‐
825 initions.
826tcpreplay 01 Jan 2023 tcpreplay-edit(1)