Hi Lothar, On 8/6/06, Lothar Braun <[EMAIL PROTECTED]> wrote: > Hi, > > i sent UDP traffic from PC1 to PC2 (port 4711) and captured it on PC2 with > > tcpdump -s 0 -i eth2 -w dumpfile udp and port 4711 > > (there's no traffic going back from PC2 to PC1) > I then tried to send the dumpfile from PC1 to PC2 using > > tcpreplay -L -i eth2 dumpfile
Uh, why are you using the -L flag? As the man page says, "bad things may happen when you use it". It's really only there because apparently someone had a corrupted or badly generated pcap file and needed a work around. I've never seen tcpdump have that problem. > Tcpdump on PC2 shows me, that the traffic arrives as expected. Do you still see the packets in tcpdump if you use the -p flag? If not, then your MAC address has changed. I'll assume of course that the IP addresses are the same. > I then tried to put an application on PC2 that listens on port 4711. But that > application does not get any data from the replayed traffic. Could be a bunch of reasons for that. Is IP Tables or other firewall running on PC2? Is the traffic valid for that application? Have you verified that that the application on port 4711 can get non-replayed traffic? Without knowing what application your running and a copy of the pcap, it's pretty hard to help much more. > My question: Is this the expected behavior? Shouldn't the application get the > traffic? Under most circumstances, yes, UDP traffic could replay just fine with tcpreplay. Regards, Aaron -- Aaron Turner http://synfin.net/ ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
