How To Install Tcpreplay On Windows

Posted on 28.12.2020admin

How To Install Tcpreplay On Windows 7
How To Install Tcpreplay On Windows10

With that said, you’ll need Cygwin to compile/run tcpreplay. You’ll also need to install Winpcap - the port of libpcap for Windows. For whatever reason, it seems important that you install the Winpcap files in the Cygwin root directory (/Wpdpack). Be sure to install both the driver and DLL files AND developer pack. /tcpreplay-4.2.5 $./configure -with-libpcap=/wpdpack After everything installing normally I get the error: Checking for libpcap. Configure: error: 'Unable to find matching library for header file in /wpdpack'.

< Home - < Back

Tcpreplay – Pcap Editing And Replay Tools For.NIX And Windows Anastasis Vasileiadis 0 Comments Tcpreplay is a suite of GPLv3 licensed utilities for UNIX (and Win32 under Cygwin ) operating systems for editing and replaying network traffic which was previously captured by tools like tcpdump and Ethereal / Wireshark. Installation of tcpreplay version 4.0 and getting started with IP Flow / Netflow testing. If detected, the network driver is bypassed for the execution duration of tcpreplay and tcpreplay-edit, and network buffers will be written to directly. This will allow you to achieve full line rates on commodity network adapters, similar to rates achieved by commercial network traffic generators.

Information about the package, tcpreplay, which is shipped with common Linux distributions. The tcpreplay package is designed for, Replay captured network traffic.

tcpreplay

Replay captured network traffic

Tcpreplay is a tool to replay captured network traffic. Currently,tcpreplay supports pcap (tcpdump) and snoop capture formats. Alsoincluded, is tcpprep a tool to pre-process capture files to allowincreased performance under certain conditions as well as capinfowhich provides basic information about capture files.

x86_64

4.2.5

1.el6

288 k

epel

GPLv3

Handy Yum Commands for tcpreplay

Control the tcpreplay package with the following handy commands outlined below.

Description of Command

This command will install tcpreplay on the server.

This command will un-install tcpreplay on the server. When you run this command, you will be asked if you are sure that you want to remove tcpreplay, so you have to manually confirm that you want to do this.

This command will un-install tcpreplay on the server. When you run this command with th e -y flag, you will not be prompted to check that you are sure you want to remove the package - so be sure you absolutely want to remove tcpreplay when using the -y flag.

This command will update tcpreplay to the latest version. When you run this command, you will be asked if you are sure that you want to remove tcpreplay, so you have to manually confirm that you want to do this.

This command will update tcpreplay to the latest version. When you run this command with the -y flag, you will not be prompted to check that you are sure you want to remove the package - so be sure you absolutely want to remove tcpreplay when using the -y flag.

This command will show you core information about the tcpreplay package.

This command will show you the dependencies for tcpreplay. Thankfully, when using Yum, if dependencies are required, these are also installed at the same time so you don't have to worry too much about that.

This command will check if there is an update waiting on tcpreplay. When you run this command this will return nothing if there is nothing to update, or, will return the package name if the package is due to be updated.

Tcpreplay is a suite of tools that allows editing and replaying previously captured traffic in libpcap format. This can come handy in many situations, one common use is traffic pattern based behavior re-creation in a lab environment.
Tcpreplay suite comes with the following tools:

tcpprep - multi-pass pcap file pre-processor which determines packets as client or server and creates cache files used by tcpreplay and tcprewrite
tcprewrite - pcap file editor which rewrites TCP/IP and Layer 2 packet headers
tcpreplay - replays pcap files at arbitrary speeds onto the network
tcpliveplay - Replays network traffic stored in a pcap file on live networks using new TCP connections
tcpreplay-edit - replays; edits pcap files at arbitrary speeds onto the network
tcpbridge - bridge two network segments with the power of tcprewrite
tcpcapinfo - raw pcap file decoder and debugger

To exemplify the use of tcpreplay, let's say we have the following setup:

Now in this setup we're interested in how our DUT device (Device Under Test) is reacting given a specific traffic pattern that is let's say very specific to this environment. I will assume the DUT is a Layer 3 device.

I will take different scenario of interest and show how tcpreplay helps.

Scenario 1: The interesting traffic pattern is unidirectional only from the client. We are not interested in what the server sends. In this case a packet capture file (I name it original.pcap) can be taken between the client and the DUT and subsequently replayed in a lab environment. I'll assume the packet capture was taken on the client itself in this example and the traffic was unidirectional. The tcpreplay environment will look as below:

The traffic capture should have the following characteristics:

Source MAC address: client MAC address / Source IP: 192.168.0.1

Destination MAC address: router MAC address / Destination IP: 172.16.0.1

Let's assume that the device running tcpreplay is a Linux device and the interface connecting it to the DUT is eth0.

What we want to do first is to rewrite the MAC addresses of the traffic (at least the destination MAC address) in order to reflect the devices involved in the traffic at replay time (source MAC address would be the tcpreplay's eth0 interface (eg. 00:11:11:11:11:11), destination mac address would be of the DUT's interface connecting to the tcpreplay box(eg. 00:22:22:22:22:22))

Now we should have a file named rewritten.pcap with the source and destination MAC addresses rewritten. The characteristics of the rewritten.pcap are now transformed to:

Source MAC address: tcpreplay eth0 MAC address / Source IP: 192.168.0.1

Destination MAC address: DUT MAC address / Destination IP: 172.16.0.

We can use now tcpreplay to replay this traffic now:

Scenario 2: The interesting traffic pattern is bidirectional. We are interested in both what the client sends as well as what the server sends. In this case a packet capture file can be taken anywhere between the client and the DUT. Now here the best option is to get the 2 packet captures: one between the client and the DUT and another between the DUT and the server and then merge them into one file. This would give us the client side packets as well as the server side packets before they are processed by the DUT. A tool to merge packet captures is mergecap and very quickly, let's say that we have 2 capture files taken:

client.pcap - taken in between the client and the router and contains packets client -> server

server.pcap - taken in between the DUT and the server and contains packets server -> client

How To Install Tcpreplay On Windows 7

mergecap -w merged.pcap client.pcap server.pcap

The packet capture file, before processing it would have the endpoint IP addresses of the client/server (192.168.0.1 and 172.16.0.1) and the MAC addresses of the client/router and server/DUT from the 1st image.

to define in our packet capture what traffic belongs to the server side and which traffic belongs to the client side
to rewrite the MAC endpoints so that they reflect our tcpreplay environment
to replay the traffic as it is in the packet capture (some packets being sent by the client and some by the server)

1. First we define which packets belong to the client and which to the server. This is done with the help of tcpprep. There are several options on how to make this separation (by IP address space - CIDR, by source MAC address, by port number, by regular expression). There are also some auto modes based on client/server traffic type, but I won't cover this here. You can check the tcpprep documentation. By default the matched packets will be associated with server side traffic.

The result of tcpprep operation will be a cachefile that will hold information about which packets belong to which side (client/server). Let's split the packet capture we have based on CIDR:

The above means all packets being sent from 172.16.0.0/24 are server sent packets. All other packets are client side packets. The file merged.cache is the file holding the information about packets direction (server/client side packets).

2. We want to rewrite the MAC addresses of the original merged.pcap packet capture to reflect the source/destination MAC addresses of our tcpreplay environment (DUT and computer running tcpreplay). We can use tcprewrite for this:

Important to note that the first MAC address in both enet-dmac and enet-smac being rewritten is the server side MAC address, the 2nd MAC address is the client side (00:22:22:22:22:23 is the destination MAC address of packets originated from the server,00:22:22:22:22:22 is the destination MAC address of the packets originated from the client; 00:11:11:11:11:11:12is the source MAC address of packets originating from the server side, 00:11:11:11:11:11:11 is the source MAC address originating from the client side). The differentiation on which packets are server side and which are client side are done again based on the cachefile previously generated with tcpprep.

3. We can use tcpreplay now to replay the file rewritten.pcap and using the merged.cache file to instruct tcpreplay to send the server originated packets on the server side bound interface (eth1) and to send the client side packets out on the client side bound interface (eth0)

Again, here is important to note that intf1 is the interface on the server side (sending server generated packets -from 172.16.0.0/24) and intf2 is the client side interface (sending packets that are not from 172.16.0.0/24).

The packets from client -> server will be sent out eth0, the packets from server -> client will be sent out eth1.

Some other uses of of the tools in the tcpreplay suite:

Fixing checksums (IPv4/TCP/UDP). The --fixcsum option forces recalculation of IPv4/TCP/UDP checksums

How To Install Tcpreplay On Windows10

Replaying the same capture file for a number of times (10 times in the example)

Replaying the packet capture not at the speed it was captured, but with a define pps (packets/second) rate (5 pps in the example)