On 7/20/07, john mcnicholas <[EMAIL PROTECTED]> wrote: > Update, this file only had a problem in "router" mode; bridge did work. > (so i could have eaten the previous question.) > > However, even after removing the packet for the questionable connection, > router mode still did NOT work.
I'd probably need to look at the pcap myself to figure out exactly why, but this isn't completely unexpected. All the auto modes use statistical analysis with a given ruleset to decide who is a client vs. server. Sometimes after being processed one or more IP's are "unknown" rather then a client or server. Hence the error. > /usr/local/bin/tcpprep --auto=router -i original_file.pcap > -o x.router.cache > Error: unable to build a valid list of servers. Aborting. > > Please note, this isn't an issue for me/us. > > For completeness: > > - bridge mode works better because it actually splits the traffic, while the > services approach > didn't split "anything". Here is the info: > > 266> /usr/local/bin/tcpprep --print-stats=x.bridge.cache > Primary packets: 24080 > #### this is the type of split > Secondary packets: 20637 > #### were looking for. > Skipped packets: 0 > ------------------------------ > Total packets: 44717 > > 267> /usr/local/bin/tcpprep --print-stats=x.services.cache > Primary packets: 0 > Secondary packets: 44717 > Skipped packets: 0 > ------------------------------ > Total packets: 44717 Well that is bad. Thanks for the heads up. > #### here's the command on the original file; good news bridge mode works. > #### Note: there is an additional packet. > 270> /usr/local/bin/tcpprep --auto=bridge -i original_file.pcap -o > x.original.bridge.cache > 271> /usr/local/bin/tcpprep --print-stats=x.original.bridge.cache > Primary packets: 24080 > Secondary packets: 20638 > Skipped packets: 0 > ------------------------------ > Total packets: 44718 > > > Many thanks for your help and the excellent tool. No prob. Regards, Aaron -- Aaron Turner http://synfin.net/ http://tcpreplay.synfin.net/ - Pcap editing & replay tools for Unix ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2005. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
