Subsections

2 Basics

3 Basic Tcpreplay Usage

3.1 Replaying the traffic

To replay a given pcap as it was captured all you need to do is specify the pcap file and the interface to send the traffic out of:

tcpreplay -i eth0 sample.pcap

3.2 Replaying at different speeds

You can also replay the traffic at different speeds then it was originally captured5. To support this, tcpreplay supports four different flags: -R, -r, -m, and -p

Some examples:

3.3 Replaying the same file over and over again

Using the loop flag (-l) you can specify that a pcap file will be sent two or more times6:

3.4 Using Configuration Files

Tcpreplay offers the options of specifying configuration options in a config file in addition to the traditional command line. Each configuration option has an equivalent config file option which is listed in the tcpreplay man page. To specify the configuration file you'd like to use, use the -f <filename> option.

Configuration files have one option per line, and lines beginning with the pound sign (#) are considered comments and ignored. An example config file follows:

# send traffic out 'eth0'
intf eth0

# loop 5 times
loop 5

# send traffic 2x as fast
multiplier 2

# pad any packets out to their original size if they were truncated during capture
untruncate pad


You would then execute:
tcpreplay -f myconfigfile sample.pcap



Footnotes

... captured5
Tcpreplay makes a "best" effort to replay traffic at the given rate, but due to limitations in hardware or the pcap file itself, it may not be possible. Capture files with only a few packets in them are especially susceptible to this.
... times6
Looping files resets internal counters which control the speed that the file is replayed. Also because the file has to be closed and re-opened, an added delay between the last and first packet may occur.
Aaron Turner 2005-02-27