🌐tcpreplay
Packages and Binaries:
tcpreplay
Tcpreplay is aimed at testing the performance of a NIDS by replaying real background network traffic in which to hide attacks. Tcpreplay allows you to control the speed at which the traffic is replayed, and can replay arbitrary tcpdump traces. Unlike programmatically-generated artificial traffic which doesn’t exercise the application/protocol inspection that a NIDS performs, and doesn’t reproduce the real-world anomalies that appear on production networks (asymmetric routes, traffic bursts/lulls, fragmentation, retransmissions, etc.), tcpreplay allows for exact replication of real traffic seen on real networks. It included the following executables tcpprep, tcprewrite, tcpreplay-edit, tcpbridge and pcap based captures are possible.
Installed size: 1.91 MB
How to install: sudo apt install tcpreplay
tcpbridge
Bridge network traffic across two interfaces
:~# tcpbridge --help
tcpbridge (tcpbridge) - Bridge network traffic across two interfaces
Usage: tcpbridge [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
:
-r, --portmap=str Rewrite TCP/UDP ports
- may appear up to 9999 times
-s, --seed=num Randomize src/dst IPv4/v6 addresses w/ given seed
- prohibits the option 'fuzz-seed'
-N, --pnat=str Rewrite IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'srcipmap'
- may appear up to 2 times
-S, --srcipmap=str Rewrite source IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'pnat'
-D, --dstipmap=str Rewrite destination IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'pnat'
--tcp-sequence=num Change TCP Sequence (and ACK) numbers /w given seed
- it must be in the range:
greater than or equal to 1
-b, --skipbroadcast Skip rewriting broadcast/multicast IPv4/v6 addresses
-C, --fixcsum Force recalculation of IPv4/TCP/UDP header checksums
-m, --mtu=num Override default MTU length (1500 bytes)
- it must be in the range:
1 to 262144
--mtu-trunc Truncate packets larger then specified MTU
-E, --efcs Remove Ethernet checksums (FCS) from end of frames
--ttl=str Modify the IPv4/v6 TTL/Hop Limit
--tos=num Set the IPv4 TOS/DiffServ/ECN byte
- it must be in the range:
0 to 255
--tclass=num Set the IPv6 Traffic Class byte
- it must be in the range:
0 to 255
--flowlabel=num Set the IPv6 Flow Label
- it must be in the range:
0 to 1048575
-F, --fixlen=str Pad or truncate packet data to match header length
--fuzz-seed=num Fuzz 1 in X packets. Edit bytes, length, or emulate packet drop
- it must be in the range:
greater than or equal to 0
--fuzz-factor=num Set the Fuzz 1 in X packet ratio (default 1 in 8 packets)
- requires the option 'fuzz-seed'
- it must be in the range:
greater than or equal to 1
--skipl2broadcast Skip rewriting broadcast/multicast Layer 2 addresses
--dlt=str Override output DLT encapsulation
--enet-dmac=str Override destination ethernet MAC addresses
--enet-smac=str Override source ethernet MAC addresses
--enet-subsmac=str Substitute MAC addresses
- may appear up to 9999 times
--enet-mac-seed=num Randomize MAC addresses
- prohibits these options:
enet-smac
enet-dmac
enet-subsmac
--enet-mac-seed-keep-bytes=num Randomize MAC addresses
- requires the option 'enet-mac-seed'
- it must be in the range:
1 to 6
--enet-vlan=str Specify ethernet 802.1q VLAN tag mode
--enet-vlan-tag=num Specify the new ethernet 802.1q VLAN tag value
- requires the option 'enet-vlan'
- it must be in the range:
0 to 4095
--enet-vlan-cfi=num Specify the ethernet 802.1q VLAN CFI value
- requires the option 'enet-vlan'
- it must be in the range:
0 to 1
--enet-vlan-pri=num Specify the ethernet 802.1q VLAN priority
- requires the option 'enet-vlan'
- it must be in the range:
0 to 7
--enet-vlan-proto=str Specify VLAN tag protocol 802.1q or 802.1ad
--hdlc-control=num Specify HDLC control value
--hdlc-address=num Specify HDLC address
--user-dlt=num Set output file DLT type
--user-dlink=str Rewrite Data-Link layer with user specified data
- may appear up to 2 times
-d, --dbug=num Enable debugging output
- it must be in the range:
0 to 5
-i, --intf1=str Primary interface (listen in uni-directional mode)
-I, --intf2=str Secondary interface (send in uni-directional mode)
-u, --unidir Send and receive in only one direction
--listnics List available network interfaces and exit
-L, --limit=num Limit the number of packets to send
- it must be in the range:
greater than or equal to 1
-M, --mac=str MAC addresses of local NIC's
- may appear up to 2 times
-x, --include=str Include only packets matching rule
- prohibits the option 'exclude'
-X, --exclude=str Exclude any packet matching this rule
- prohibits the option 'include'
-P, --pid Print the PID of tcpbridge at startup
-v, --verbose Print decoded packets via tcpdump to STDOUT
-A, --decode=str Arguments passed to tcpdump decoder
- requires the option 'verbose'
-V, --version Print version information
-h, --less-help Display less usage information and exit
Version, usage and configuration options:
-H, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
--save-opts[=arg] save the option state to a config file
--load-opts=str load options from a config file
- disabled as '--no-load-opts'
- may appear multiple times
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
tcpbridge is a tool for selectively bridging network traffic across two
interfaces and optionally modifying the packets in between
The following option preset mechanisms are supported:
- reading file /usr/bin/.tcpbridgerc
The basic operation of tcpbridge is to be a network bridge between two
subnets. All packets received on one interface are sent via the other.
Optionally, packets can be edited in a variety of ways according to your
needs.
For more details, please see the Tcpreplay Manual at:
http://tcpreplay.appneta.com
Please send bug reports to: <>tcpcapinfo
Pcap file dissector for debugging broken pcap files
:~# tcpcapinfo --help
tcpcapinfo (Tcpreplay Suite) - Pcap file dissector for debugging broken pcap files
Usage: tcpcapinfo [ -<flag> [<val>] | --<name>[{=| }<val>] ]... <pcap_file(s)>
-d, --dbug=num Enable debugging output
- it must be in the range:
0 to 5
-V, --version Print version information
-H, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
tcpcapinfo is a tool for decoding the structure of a pcap(3) file with a
focus on finding broken pcap files and determining how two related pcap
files might differ.
tcpcapinfo will first print out the pcap_file_header_t in human readable
form followed by a per-packet summary including the pcap_pkthdr_t and
simple checksum value of the packet.
Please send bug reports to: <>tcpliveplay
Replays network traffic stored in a pcap file on live networks using new TCP connections
:~# tcpliveplay --help
tcpliveplay (tcpliveplay) - Replays network traffic stored in a pcap file on live networks using new TCP connections
Usage: tcpliveplay [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \
<eth0/eth1> <file.pcap> <Destination IP [1.2.3.4]> <Destination mac [0a:1b:2c:3d:4e:5f]> <'random' dst port OR specify dport #>
-d, --dbug=num Enable debugging output
- it must be in the range:
0 to 5
-V, --version Print version information
-h, --less-help Display less usage information and exit
-H, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
--save-opts[=arg] save the option state to a config file
--load-opts=str load options from a config file
- disabled as '--no-load-opts'
- may appear multiple times
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
This program, 'tcpliveplay' replays a captured set of packets using new TCP
connections with the captured TCP payloads against a remote host in order
to do comprehensive vulnerability testing.
The following option preset mechanisms are supported:
- reading file /usr/bin/.tcpliveplayrc
The basic operation of tcpliveplay is it rewrites the given pcap file in a
scheduled event format and responds with the appropriate packet if the
remote host meets tcp protocal's SEQ/ACK expectation. Once expectations
are met, then the local packets are sent with the same payload except with
new tcp SEQ & ACK numbers meeting the response from the remote hose.
The input pcap file are rewritten to start at the first encounter of the
SYN packet for correct operation making this packet be the first action in
the event schedule of local host doing the replay.
For more details, please see the Tcpreplay Manual at:
http://tcpreplay.appneta.comtcpprep
Create a tcpreplay cache cache file from a pcap file.
:~# tcpprep --help
tcpprep (tcpprep) - Create a tcpreplay cache cache file from a pcap file.
Usage: tcpprep [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
-d, --dbug=num Enable debugging output
- it must be in the range:
0 to 5
-a, --auto=str Auto-split mode
- prohibits these options:
cidr
port
regex
mac
-c, --cidr=str CIDR-split mode
- prohibits these options:
auto
port
regex
mac
-r, --regex=str Regex-split mode
- prohibits these options:
auto
port
cidr
mac
-p, --port Port-split mode
- prohibits these options:
auto
regex
cidr
mac
-e, --mac=str Source MAC split mode
- prohibits these options:
auto
regex
cidr
port
--reverse Matches to be client instead of server
-C, --comment=str Embedded cache file comment
--no-arg-comment Do not embed any cache file comment
-x, --include=str Include only packets matching rule
- prohibits the option 'exclude'
-X, --exclude=str Exclude any packet matching this rule
- prohibits the option 'include'
-o, --cachefile=str Output cache file
-i, --pcap=str Input pcap file to process
-P, --print-comment=str Print embedded comment in the specified cache file
-I, --print-info=str Print basic info from the specified cache file
-S, --print-stats=str Print statistical information about the specified cache file
-s, --services=str Load services file for server ports
- requires the option 'port'
-N, --nonip Send non-IP traffic out server interface
-R, --ratio=str Ratio of client to server packets
- requires the option 'auto'
-m, --minmask=num Minimum network mask length in auto mode
- requires the option 'auto'
- it must be in the range:
0 to 32
-M, --maxmask=num Maximum network mask length in auto mode
- requires the option 'auto'
- it must be in the range:
0 to 32
-v, --verbose Print decoded packets via tcpdump to STDOUT
-A, --decode=str Arguments passed to tcpdump decoder
- requires the option 'verbose'
-V, --version Print version information
-h, --less-help Display less usage information and exit
-H, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
--save-opts[=arg] save the option state to a config file
--load-opts=str load options from a config file
- disabled as '--no-load-opts'
- may appear multiple times
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
tcpprep is a 'pcap(3)' file pre-processor which creates a cache file which
provides "rules" for 'tcprewrite(1)' and 'tcpreplay(1)' on how to process
and send packets.
The following option preset mechanisms are supported:
- reading file /usr/bin/.tcppreprc
The basic operation of tcpreplay is to resend all packets from the input
file(s) out a single file. Tcpprep processes a pcap file and applies a set
of user-specified rules to create a cache file which tells tcpreplay
whether or not to send each packet and which interface the packet should be
sent out of.
For more details, please see the Tcpreplay Manual at:
http://tcpreplay.appneta.com
Please send bug reports to: <>tcpreplay
Replay network traffic stored in pcap files
:~# tcpreplay --help
tcpreplay (tcpreplay) - Replay network traffic stored in pcap files
Usage: tcpreplay [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \
<pcap_file(s)> | <pcap_dir(s)>
-d, --dbug=num Enable debugging output
- it must be in the range:
0 to 5
-q, --quiet Quiet mode
-T, --timer=str Select packet timing mode: select, ioport, gtod, nano
--maxsleep=num Sleep for no more then X milliseconds between packets
-v, --verbose Print decoded packets via tcpdump to STDOUT
-A, --decode=str Arguments passed to tcpdump decoder
- requires the option 'verbose'
-K, --preload-pcap Preloads packets into RAM before sending
-c, --cachefile=str Split traffic via a tcpprep cache file
- requires the option 'intf2'
-- and prohibits the option 'dualfile'
-2, --dualfile Replay two files at a time from a network tap
- requires the option 'intf2'
-- and prohibits the option 'cachefile'
-i, --intf1=str Client to server/RX/primary traffic output interface
-I, --intf2=str Server to client/TX/secondary traffic output interface
--listnics List available network interfaces and exit
-l, --loop=num Loop through the capture file X times
- it must be in the range:
greater than or equal to 0
--loopdelay-ms=num Delay between loops in milliseconds
- requires the option 'loop'
- it must be in the range:
greater than or equal to 0
--pktlen Override the snaplen and use the actual packet len
-L, --limit=num Limit the number of packets to send
- it must be in the range:
greater than or equal to 1
--duration=num Limit the number of seconds to send
- it must be in the range:
greater than or equal to 1
-x, --multiplier=str Modify replay speed to a given multiple
- prohibits these options:
pps
mbps
oneatatime
topspeed
-p, --pps=str Replay packets at a given packets/sec
- prohibits these options:
multiplier
mbps
oneatatime
topspeed
-M, --mbps=str Replay packets at a given Mbps
- prohibits these options:
multiplier
pps
oneatatime
topspeed
-t, --topspeed Replay packets as fast as possible
- prohibits these options:
mbps
multiplier
pps
oneatatime
-o, --oneatatime Replay one packet at a time for each user input
- prohibits these options:
mbps
pps
multiplier
topspeed
--pps-multi=num Number of packets to send for each time interval
- requires the option 'pps'
- it must be in the range:
greater than or equal to 1
--unique-ip Modify IP addresses each loop iteration to generate unique flows
- requires the option 'loop'
--unique-ip-loops=str Number of times to loop before assigning new unique ip
- requires the option 'unique-ip'
--no-flow-stats Suppress printing and tracking flow count, rates and expirations
--flow-expiry=num Number of inactive seconds before a flow is considered expired
- prohibits the option 'no-flow-stats'
- it must be in the range:
greater than or equal to 0
-P, --pid Print the PID of tcpreplay at startup
--stats=num Print statistics every X seconds, or every loop if '0'
- it must be in the range:
greater than or equal to 0
-V, --version Print version information
-h, --less-help Display less usage information and exit
-H, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
--save-opts[=arg] save the option state to a config file
--load-opts=str load options from a config file
- disabled as '--no-load-opts'
- may appear multiple times
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
tcpreplay is a tool for replaying network traffic from files saved with
tcpdump or other tools which write pcap(3) files.
The following option preset mechanisms are supported:
- reading file /usr/bin/.tcpreplayrc
The basic operation of tcpreplay is to resend all packets from the input
file(s) at the speed at which they were recorded, or a specified data rate,
up to as fast as the hardware is capable.
Optionally, the traffic can be split between two interfaces, written to
files, filtered and edited in various ways, providing the means to test
firewalls, NIDS and other network devices.
For more details, please see the Tcpreplay Manual at:
http://tcpreplay.appneta.com
Please send bug reports to: <>tcpreplay-edit
Replay network traffic stored in pcap files
:~# tcpreplay-edit --help
tcpreplay (tcpreplay) - Replay network traffic stored in pcap files
Usage: tcpreplay-edit [ -<flag> [<val>] | --<name>[{=| }<val>] ]... \
<pcap_file(s)> | <pcap_dir(s)>
:
-r, --portmap=str Rewrite TCP/UDP ports
- may appear up to 9999 times
-s, --seed=num Randomize src/dst IPv4/v6 addresses w/ given seed
- prohibits the option 'fuzz-seed'
-N, --pnat=str Rewrite IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'srcipmap'
- may appear up to 2 times
-S, --srcipmap=str Rewrite source IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'pnat'
-D, --dstipmap=str Rewrite destination IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'pnat'
-e, --endpoints=str Rewrite IP addresses to be between two endpoints
- requires the option 'cachefile'
--tcp-sequence=num Change TCP Sequence (and ACK) numbers /w given seed
- it must be in the range:
greater than or equal to 1
-b, --skipbroadcast Skip rewriting broadcast/multicast IPv4/v6 addresses
-C, --fixcsum Force recalculation of IPv4/TCP/UDP header checksums
-m, --mtu=num Override default MTU length (1500 bytes)
- it must be in the range:
1 to 262144
--mtu-trunc Truncate packets larger then specified MTU
-E, --efcs Remove Ethernet checksums (FCS) from end of frames
--ttl=str Modify the IPv4/v6 TTL/Hop Limit
--tos=num Set the IPv4 TOS/DiffServ/ECN byte
- it must be in the range:
0 to 255
--tclass=num Set the IPv6 Traffic Class byte
- it must be in the range:
0 to 255
--flowlabel=num Set the IPv6 Flow Label
- it must be in the range:
0 to 1048575
-F, --fixlen=str Pad or truncate packet data to match header length
--fuzz-seed=num Fuzz 1 in X packets. Edit bytes, length, or emulate packet drop
- it must be in the range:
greater than or equal to 0
--fuzz-factor=num Set the Fuzz 1 in X packet ratio (default 1 in 8 packets)
- requires the option 'fuzz-seed'
- it must be in the range:
greater than or equal to 1
--skipl2broadcast Skip rewriting broadcast/multicast Layer 2 addresses
--dlt=str Override output DLT encapsulation
--enet-dmac=str Override destination ethernet MAC addresses
--enet-smac=str Override source ethernet MAC addresses
--enet-subsmac=str Substitute MAC addresses
- may appear up to 9999 times
--enet-mac-seed=num Randomize MAC addresses
- prohibits these options:
enet-smac
enet-dmac
enet-subsmac
--enet-mac-seed-keep-bytes=num Randomize MAC addresses
- requires the option 'enet-mac-seed'
- it must be in the range:
1 to 6
--enet-vlan=str Specify ethernet 802.1q VLAN tag mode
--enet-vlan-tag=num Specify the new ethernet 802.1q VLAN tag value
- requires the option 'enet-vlan'
- it must be in the range:
0 to 4095
--enet-vlan-cfi=num Specify the ethernet 802.1q VLAN CFI value
- requires the option 'enet-vlan'
- it must be in the range:
0 to 1
--enet-vlan-pri=num Specify the ethernet 802.1q VLAN priority
- requires the option 'enet-vlan'
- it must be in the range:
0 to 7
--enet-vlan-proto=str Specify VLAN tag protocol 802.1q or 802.1ad
--hdlc-control=num Specify HDLC control value
--hdlc-address=num Specify HDLC address
--user-dlt=num Set output file DLT type
--user-dlink=str Rewrite Data-Link layer with user specified data
- may appear up to 2 times
-d, --dbug=num Enable debugging output
- it must be in the range:
0 to 5
-q, --quiet Quiet mode
-T, --timer=str Select packet timing mode: select, ioport, gtod, nano
--maxsleep=num Sleep for no more then X milliseconds between packets
-v, --verbose Print decoded packets via tcpdump to STDOUT
-A, --decode=str Arguments passed to tcpdump decoder
- requires the option 'verbose'
-K, --preload-pcap Preloads packets into RAM before sending
-c, --cachefile=str Split traffic via a tcpprep cache file
- requires the option 'intf2'
-- and prohibits the option 'dualfile'
-2, --dualfile Replay two files at a time from a network tap
- requires the option 'intf2'
-- and prohibits the option 'cachefile'
-i, --intf1=str Client to server/RX/primary traffic output interface
-I, --intf2=str Server to client/TX/secondary traffic output interface
--listnics List available network interfaces and exit
-l, --loop=num Loop through the capture file X times
- it must be in the range:
greater than or equal to 0
--loopdelay-ms=num Delay between loops in milliseconds
- requires the option 'loop'
- it must be in the range:
greater than or equal to 0
--pktlen Override the snaplen and use the actual packet len
-L, --limit=num Limit the number of packets to send
- it must be in the range:
greater than or equal to 1
--duration=num Limit the number of seconds to send
- it must be in the range:
greater than or equal to 1
-x, --multiplier=str Modify replay speed to a given multiple
- prohibits these options:
pps
mbps
oneatatime
topspeed
-p, --pps=str Replay packets at a given packets/sec
- prohibits these options:
multiplier
mbps
oneatatime
topspeed
-M, --mbps=str Replay packets at a given Mbps
- prohibits these options:
multiplier
pps
oneatatime
topspeed
-t, --topspeed Replay packets as fast as possible
- prohibits these options:
mbps
multiplier
pps
oneatatime
-o, --oneatatime Replay one packet at a time for each user input
- prohibits these options:
mbps
pps
multiplier
topspeed
--pps-multi=num Number of packets to send for each time interval
- requires the option 'pps'
- it must be in the range:
greater than or equal to 1
--unique-ip Modify IP addresses each loop iteration to generate unique flows
- requires the option 'loop'
-- and prohibits these options:
seed
fuzz-seed
--unique-ip-loops=str Number of times to loop before assigning new unique ip
- requires the option 'unique-ip'
--no-flow-stats Suppress printing and tracking flow count, rates and expirations
--flow-expiry=num Number of inactive seconds before a flow is considered expired
- prohibits the option 'no-flow-stats'
- it must be in the range:
greater than or equal to 0
-P, --pid Print the PID of tcpreplay at startup
--stats=num Print statistics every X seconds, or every loop if '0'
- it must be in the range:
greater than or equal to 0
-V, --version Print version information
-h, --less-help Display less usage information and exit
Version, usage and configuration options:
-H, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
--save-opts[=arg] save the option state to a config file
--load-opts=str load options from a config file
- disabled as '--no-load-opts'
- may appear multiple times
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
tcpreplay is a tool for replaying network traffic from files saved with
tcpdump or other tools which write pcap(3) files.
The following option preset mechanisms are supported:
- reading file /usr/bin/.tcpreplayrc
The basic operation of tcpreplay is to resend all packets from the input
file(s) at the speed at which they were recorded, or a specified data rate,
up to as fast as the hardware is capable.
Optionally, the traffic can be split between two interfaces, written to
files, filtered and edited in various ways, providing the means to test
firewalls, NIDS and other network devices.
For more details, please see the Tcpreplay Manual at:
http://tcpreplay.appneta.com
Please send bug reports to: <>tcprewrite
Rewrite the packets in a pcap file.
root:~# tcprewrite --help
tcprewrite (tcprewrite) - Rewrite the packets in a pcap file.
Usage: tcprewrite [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
:
-r, --portmap=str Rewrite TCP/UDP ports
- may appear up to 9999 times
-s, --seed=num Randomize src/dst IPv4/v6 addresses w/ given seed
- prohibits the option 'fuzz-seed'
-N, --pnat=str Rewrite IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'srcipmap'
- may appear up to 2 times
-S, --srcipmap=str Rewrite source IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'pnat'
-D, --dstipmap=str Rewrite destination IPv4/v6 addresses using pseudo-NAT
- prohibits the option 'pnat'
-e, --endpoints=str Rewrite IP addresses to be between two endpoints
- requires the option 'cachefile'
--tcp-sequence=num Change TCP Sequence (and ACK) numbers /w given seed
- it must be in the range:
greater than or equal to 1
-b, --skipbroadcast Skip rewriting broadcast/multicast IPv4/v6 addresses
-C, --fixcsum Force recalculation of IPv4/TCP/UDP header checksums
-m, --mtu=num Override default MTU length (1500 bytes)
- it must be in the range:
1 to 262144
--mtu-trunc Truncate packets larger then specified MTU
-E, --efcs Remove Ethernet checksums (FCS) from end of frames
--ttl=str Modify the IPv4/v6 TTL/Hop Limit
--tos=num Set the IPv4 TOS/DiffServ/ECN byte
- it must be in the range:
0 to 255
--tclass=num Set the IPv6 Traffic Class byte
- it must be in the range:
0 to 255
--flowlabel=num Set the IPv6 Flow Label
- it must be in the range:
0 to 1048575
-F, --fixlen=str Pad or truncate packet data to match header length
--fuzz-seed=num Fuzz 1 in X packets. Edit bytes, length, or emulate packet drop
- it must be in the range:
greater than or equal to 0
--fuzz-factor=num Set the Fuzz 1 in X packet ratio (default 1 in 8 packets)
- requires the option 'fuzz-seed'
- it must be in the range:
greater than or equal to 1
--skipl2broadcast Skip rewriting broadcast/multicast Layer 2 addresses
--dlt=str Override output DLT encapsulation
--enet-dmac=str Override destination ethernet MAC addresses
--enet-smac=str Override source ethernet MAC addresses
--enet-subsmac=str Substitute MAC addresses
- may appear up to 9999 times
--enet-mac-seed=num Randomize MAC addresses
- prohibits these options:
enet-smac
enet-dmac
enet-subsmac
--enet-mac-seed-keep-bytes=num Randomize MAC addresses
- requires the option 'enet-mac-seed'
- it must be in the range:
1 to 6
--enet-vlan=str Specify ethernet 802.1q VLAN tag mode
--enet-vlan-tag=num Specify the new ethernet 802.1q VLAN tag value
- requires the option 'enet-vlan'
- it must be in the range:
0 to 4095
--enet-vlan-cfi=num Specify the ethernet 802.1q VLAN CFI value
- requires the option 'enet-vlan'
- it must be in the range:
0 to 1
--enet-vlan-pri=num Specify the ethernet 802.1q VLAN priority
- requires the option 'enet-vlan'
- it must be in the range:
0 to 7
--enet-vlan-proto=str Specify VLAN tag protocol 802.1q or 802.1ad
--hdlc-control=num Specify HDLC control value
--hdlc-address=num Specify HDLC address
--user-dlt=num Set output file DLT type
--user-dlink=str Rewrite Data-Link layer with user specified data
- may appear up to 2 times
-d, --dbug=num Enable debugging output
- it must be in the range:
0 to 5
-i, --infile=str Input pcap file to be processed
-o, --outfile=str Output pcap file
-c, --cachefile=str Split traffic via tcpprep cache file
-v, --verbose Print decoded packets via tcpdump to STDOUT
-A, --decode=str Arguments passed to tcpdump decoder
- requires the option 'verbose'
--fragroute=str Parse fragroute configuration file
--fragdir=str Which flows to apply fragroute to: c2s, s2c, both
- requires the option 'cachefile'
--skip-soft-errors Skip writing packets with soft errors
-V, --version Print version information
-h, --less-help Display less usage information and exit
Version, usage and configuration options:
-H, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
--save-opts[=arg] save the option state to a config file
--load-opts=str load options from a config file
- disabled as '--no-load-opts'
- may appear multiple times
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
The following option preset mechanisms are supported:
- reading file /usr/bin/.tcprewriterc
Tcprewrite is a tool to rewrite packets stored in 'pcap(3)' file format,
such as created by tools such as 'tcpdump(1)' and 'wireshark(1)'. Once a
pcap file has had it's packets rewritten, they can be replayed back out on
the network using 'tcpreplay(1)'.
tcprewrite currently supports reading the following DLT types:
'DLT_C_HDLC' aka Cisco HDLC
'DLT_EN10MB' aka Ethernet
'DLT_LINUX_SLL' aka Linux Cooked Socket
'DLT_RAW' aka RAW IP
'DLT_NULL' aka BSD Loopback
'DLT_LOOP' aka OpenBSD Loopback
'DLT_IEEE802_11' aka 802.11a/b/g
'DLT_IEEE802_11_RADIO' aka 802.11a/b/g with Radiotap headers
'DLT_JUNIPER_ETHER' aka Juniper Encapsulated Ethernet
'DLT_PPP_SERIAL' aka PPP over Serial
Please see the --dlt option for supported DLT types for writing.
The packet editing features of tcprewrite which distinguish between
"client" and "server" traffic requires a tcpprep(1) cache file.
For more details, please see the Tcpreplay Manual at:
http://tcpreplay.appneta.com
Please send bug reports to: <>Updated on: 2023-Mar-08
Last updated