1TCPREPLAY(1) Programmer's Manual TCPREPLAY(1)
2
6 tcpreplay - Replay network traffic stored in pcap files
7
9 tcpreplay [-flag [value]]... [--opt-name [[=| ]value]]...
10 <pcap_file(s)>
11 tcpreplay is a tool for replaying network traffic from files saved with
13 tcpdump or other tools which write pcap(3) files.
14
16 This manual page documents, briefly, the tcpreplay command. The basic
17 operation of tcpreplay is to resend all packets from the input
18 file(s) at the speed at which they were recorded, or a specified data
19 rate, up to as fast as the hardware is capable.
20 Optionally, the traffic can be split between two interfaces, written to
22 files, filtered and edited in various ways, providing the means to test
23 firewalls, NIDS and other network devices.
24 For more details, please see the Tcpreplay Manual at: http://tcpre‐
26 play.synfin.net/trac/wiki/manual
27
29 -d number, --dbug=number
30 Enable debugging output. This option may appear up to 1 times.
31 This option takes an integer number as its argument. The value
32 of number is constrained to being:
33 in the range 0 through 5
34 The default number for this option is:
35 0
36 If configured with --enable-debug, then you can specify a ver‐
38 bosity level for debugging output. Higher numbers increase ver‐
39 bosity.
40 -q, --quiet
42 Quiet mode.
43 Print nothing except the statistics at the end of the run
45 -T string, --timer=string
47 Select packet timing mode: select, ioport, rdtsc, gtod, nano,
48 abstime. This option may appear up to 1 times. The default
49 string for this option is:
50 gtod
51 Allows you to select the packet timing method to use:
53 nano - Use nanosleep() API
55 select - Use select() API
57 ioport - Write to the i386 IO Port 0x80
59 rdtsc - Use the x86/x86_64/PPC RDTSC
61 gtod [default] - Use a gettimeofday() loop
63 abstime - Use OS X's AbsoluteTime API
65 --sleep-accel=number
68 Reduce the amount of time to sleep by specified usec. This
69 option takes an integer number as its argument. The default
70 number for this option is:
71 0
72 Reduce the amount of time we would normally sleep between two
74 packets by the specified number of usec. This provides a "fuzz
75 factor" to compensate for running on a non-RTOS and other pro‐
76 cesses using CPU time. Default is disabled.
77 --rdtsc-clicks=number
79 Specify the RDTSC clicks/usec. This option may appear up to 1
80 times. This option takes an integer number as its argument.
81 The default number for this option is:
82 0
83 Override the calculated number of RDTSC clicks/usec which is
85 often the speed of the CPU in Mhz. Only useful if you specified
86 --timer=rdtsc
87 -v, --verbose
89 Print decoded packets via tcpdump to STDOUT. This option may
90 appear up to 1 times.
91 -A string, --decode=string
95 Arguments passed to tcpdump decoder. This option may appear up
96 to 1 times. This option must appear in combination with the
97 following options: verbose.
98 When enabling verbose mode (-v) you may also specify one or more
100 additional arguments to pass to tcpdump to modify the way pack‐
101 ets are decoded. By default, -n and -l are used. Be sure to
102 quote the arguments like: -A "-axxx" so that they are not inter‐
103 preted by tcpreplay. Please see the tcpdump(1) man page for a
104 complete list of options.
105 -K, --enable-file-cache
107 Enable caching of packets to internal memory. This option must
108 appear in combination with the following options: loop.
109 Cache pcap file(s) the first time they are cached in RAM so that
111 subsequent loops don't incurr any disk I/O latency in order to
112 increase performance. Make sure you have enough free RAM to
113 store the entire pcap file(s) in memory or the system will swap
114 and performance will suffer.
115 -c string, --cachefile=string
117 Split traffic via a tcpprep cache file. This option may appear
118 up to 1 times.
119 -i string, --intf1=string
123 Server/primary traffic output interface. This option may appear
124 up to 1 times.
125 -I string, --intf2=string
129 Client/secondary traffic output interface. This option may
130 appear up to 1 times. This option must appear in combination
131 with the following options: cachefile.
132 -l number, --loop=number
136 Loop through the capture file X times. This option may appear
137 up to 1 times. This option takes an integer number as its argu‐
138 ment. The value of number is constrained to being:
139 greater than or equal to 0
140 The default number for this option is:
141 1
142 --pktlen
146 Override the snaplen and use the actual packet len. This option
147 may appear up to 1 times.
148 By default, tcpreplay will send packets based on the size of the
150 "snaplen" stored in the pcap file which is usually the correct
151 thing to do. However, occasionally, tools will store more bytes
152 then told to. By specifying this option, tcpreplay will ignore
153 the snaplen field and instead try to send packets based on the
154 original packet length. Bad things may happen if you specify
155 this option.
156 -L number, --limit=number
158 Limit the number of packets to send. This option may appear up
159 to 1 times. This option takes an integer number as its argu‐
160 ment. The value of number is constrained to being:
161 greater than or equal to 1
162 The default number for this option is:
163 -1
164 By default, tcpreplay will send all the packets. Alternatively,
166 you can specify a maximum number of packets to send.
167 -x string, --multiplier=string
169 Modify replay speed to a given multiple. This option may appear
170 up to 1 times. This option must not appear in combination with
171 any of the following options: pps, mbps, oneatatime, topspeed.
172 Specify a floating point value to modify the packet replay
174 speed. Examples:
175 2.0 will replay traffic at twice the speed captured
176 0.7 will replay traffic at 70% the speed captured
177 -p number, --pps=number
179 Replay packets at a given packets/sec. This option may appear
180 up to 1 times. This option must not appear in combination with
181 any of the following options: multiplier, mbps, oneatatime, top‐
182 speed. This option takes an integer number as its argument.
183 -M string, --mbps=string
187 Replay packets at a given Mbps. This option may appear up to 1
188 times. This option must not appear in combination with any of
189 the following options: multiplier, pps, oneatatime, topspeed.
190 Specify a floating point value for the Mbps rate that tcpreplay
192 should send packets at.
193 -t, --topspeed
195 Replay packets as fast as possible. This option must not appear
196 in combination with any of the following options: mbps, multi‐
197 plier, pps, oneatatime.
198 -o, --oneatatime
202 Replay one packet at a time for each user input. This option
203 must not appear in combination with any of the following
204 options: mbps, pps, multiplier, topspeed.
205 Allows you to step through one or more packets at a time.
207 -P, --pid
209 Print the PID of tcpreplay at startup.
210 -V, --version
214 Print version information.
215 -h, --less-help
219 Display less usage information and exit.
220 -H, --help
224 Display usage information and exit.
225 -!, --more-help
227 Extended usage information passed thru pager.
228 - [rcfile], --save-opts[=rcfile]
230 Save the option state to rcfile. The default is the last con‐
231 figuration file listed in the OPTION PRESETS section, below.
232 - rcfile, --load-opts=rcfile, --no-load-opts
234 Load options from rcfile. The no-load-opts form will disable
235 the loading of earlier RC/INI files. --no-load-opts is handled
236 early, out of order.
237
239 Any option that is not marked as not presettable may be preset by load‐
240 ing values from configuration ("RC" or ".INI") file(s). The homerc
241 file is "$$/", unless that is a directory. In that case, the file
242 ".tcpreplayrc" is searched for within that directory.
243
245 tcpreplay understands the following signals:
246 SIGUSR1 Suspend tcpreplay
248 SIGCONT Restart tcpreplay
250
253 tcpreplay-edit(1), tcpdump(1), tcpprep(1), tcprewrite(1), libnet(3)
254
257 tcpreplay can only send packets as fast as your computer's interface,
258 processor, disk and system bus will allow.
259 Packet timing at high speeds is a black art and very OS/CPU dependent.
261 Replaying captured traffic may simulate odd or broken conditions on
263 your network and cause all sorts of problems.
264 In most cases, you can not replay traffic back to/at a server.
266 Some operating systems by default do not allow for forging source MAC
268 addresses. Please consult your operating system's documentation and
269 the tcpreplay FAQ if you experience this issue.
270
272 Copyright 2000-2008 Aaron Turner
273 For support please use the tcpreplay-users@lists.sourceforge.net mail‐
275 ing list.
276 The latest version of this software is always available from:
278 http://tcpreplay.synfin.net/
279 Released under the Free BSD License.
281 This manual page was AutoGen-erated from the tcpreplay option defini‐
283 tions.
284(tcpreplay ) 2008-05-15 TCPREPLAY(1)