On 8/8/06, Roy S. Rapoport <[EMAIL PROTECTED]> wrote: > > I used > tcprewrite --dlink=00,02,03,04,05,06,00,1A,2B,3C,4D,5E,6F,08,00 --dlt=1 \ > --infile foo.pcap --outfile foo.pcap.dlt > > This definitely seemed to give me a hint -- I've been able to create the > ethernet header (by simply stealing it from what ethernet showed). The > problem I now have is that in addition to redoing the MAC addresses, I > want to rewrite the IP addresses -- and using --endpoints tells me I have > to use cachefile; when I create the cachefile via > tcpprep -i infile.pcap -o infile.cache -p > and then run tcprewrite with > tcprewrite --dlink 00,e0,80,50,f7,00,00,07,e9,d4,38,bf,08,00 \ > --dlt 1 \ > --infile infile.pcap --endpoints 64.125.37.1:64.125.37.25 > --outfile outfile.pcap \ > --cachefile infile.cache > > I get: > Error rewriting packets: Unsupported protocol for checksum: 5
My guess is that tcpreplay is getting confused with the changing offsets for the start of layer 3. The solution I would pose is running tcprewrite twice: tcprewrite --dlink=00,e0,80,50,f7,00,00,07,e9,d4,38,bf,08,00 --dlt=1 --infile=infile.pcap --outfile=out1.pcap tcprewrite --cachefile=infile.cache --endpoints=64.125.37.1:64.125.37.25 --infile=outtemp.pcap --outfile=outfile.pcap You may also want to use the --smac/--dmac options in the 2nd execution to rewrite the mac addresses of the packets so that the source/destination mac addresses match up with the new IP's, otherwise every packet will have the same src & dst mac as specified by --dlink. -- Aaron Turner http://synfin.net/ ------------------------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
