This doesn't exactly answer your question, but...
I've found that bittwiste (http://bittwist.sourceforge.net/) does a good job
of editing pcap files when I can't get tcprewrite to do what I want. You
might try this as a work around for now.
-Andrew
--- Sharon Rozenblum <[EMAIL PROTECTED]> wrote:
> Hi!
>
> Thanks!
>
> First checks look fine!
>
> ************************************************************************
> ****
>
> Another problem (?) I am facing:
>
> When working with big files, the tcpprep does not finish - when trying
> to split according to subnet ("CDIR") - consuming a lot of memory - till
> killed by the system...
>
> Any idea what can cause it?
>
> E.G.
>
> Dump file with 2.5M packets, 300 Mbyte size,ftp traffic between 20+
> client ip's & 1 server ip (a lot of sessions with a lot of port
> numbers...)
>
> ???
>
> Splitting with --regex="XXX" (e.g. --regex="(168)\..*" when my server-ip
> is 168.10.3.1) looks beter - means - command that does not finished with
> "CDIR" worked with "regex" but took a lot of time (10+ minutes to the
> above sample!)
>
> Is it the expected behavior?
>
> -----Original Message-----
> From: [EMAIL PROTECTED]
> [mailto:[EMAIL PROTECTED] On Behalf Of
> Aaron Turner
> Sent: Friday, April 27, 2007 8:45 AM
> To: Main forum for tcpreplay
> Subject: Re: [Tcpreplay-users] Can I change source-ip to another ip?
>
>
> Hi Sharon,
>
> Grab 3.0, and apply this patch. Let me know how it goes.
>
> On 4/26/07, Sharon Rozenblum <[EMAIL PROTECTED]> wrote:
> > I will be glad to test the patch :-)
> >
>
> --
> Aaron Turner
> http://synfin.net/
> http://tcpreplay.synfin.net/ - Pcap editing & replay tools for Unix
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by DB2 Express
> Download DB2 Express C - the FREE version of DB2 express and take
> control of your XML. No limits. Just data. Click to get it now.
> http://sourceforge.net/powerbar/db2/
> _______________________________________________
> Tcpreplay-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
>
-Andrew Feren
[EMAIL PROTECTED]
-------------------------------------------------------------------------
This SF.net email is sponsored by DB2 Express
Download DB2 Express C - the FREE version of DB2 express and take
control of your XML. No limits. Just data. Click to get it now.
http://sourceforge.net/powerbar/db2/
_______________________________________________
Tcpreplay-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
