On 16.07.2007, at 01:15, Aaron Turner wrote: > On 7/15/07, Torsten Curdt <[EMAIL PROTECTED]> wrote: >> I send one UDP packet from a client to a server machine. I capture it >> on the server with >> >> tcpdump -i eth0 -s0 -p -n dst port 32333 -w sample.pcap >> >> Then I start tcpdump on the server just to see what's coming in >> >> tcpdump -i eth0 -p -n -v dst port 32333 >> >> Now when I am sending the UDP packet from the client machine. I see >> the proper entry printed on stdout from tcpdump, the server receives >> the packet and all is good. >> >> 00:50:27.638482 IP (tos 0x0, ttl 51, id 62640, offset 0, flags >> [none], proto: UDP (17), length: 171) 84.58.12.57.31959 > >> 89.241.0.139.32333: UDP, length 143 >> >> When I replay the captured packet on the server though >> >> tcpreplay -i eth0 sample.pcap >> >> I can see it printed out on tcpdump but the server is not receiving >> the packet. >> >> 00:50:23.250751 IP (tos 0x0, ttl 51, id 174, offset 0, flags >> [none], proto: UDP (17), length: 171) 84.58.12.57.32148 > >> 89.241.0.139.32333: UDP, length 143 >> >> I assume that means that the kernel basically is dropping the packet. >> But as this time the MAC address does not need to be changed I am not >> quite sure why the server does not see the packet. > > The host that is running tcpreplay will not process outgoing packets. > This is because tcpreplay uses low level sockets to write the packet > which bypasses the IP stack of the host. > > Your choices are: > 1) Replay the traffic from a different host
Hm... replayed the same pcap on a different host from within the same subnet. I don't see any traffic coming in on the server at all :( Doing echo test|nc -u 89.241.0.139 32333 from that host I see on the server though. > 2) Replay the traffic on the same host, but from a different interface > (eth1 for example) Hmm... does that interface need to be on the same subnet? ...because replaying on either the 172.x, the 10.x or lo interfaces doesn't help either. cheers -- Torsten ------------------------------------------------------------------------- This SF.net email is sponsored by DB2 Express Download DB2 Express C - the FREE version of DB2 express and take control of your XML. No limits. Just data. Click to get it now. http://sourceforge.net/powerbar/db2/ _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
