On Fri, May 23, 2008 at 06:55:35PM -0400, Mohamed Kouki wrote: > Hi , yes the problem is with timestamp , i already tried that by mergecap but > all the flow starts at the same time even when replaying the trace by > tcpreplay the flows are replayed sequencely but the time between flows is > random > <br> > <br><br><br><br><br><br><blockquote style='border-top: 1px solid rgb(204, > 204, 204); margin: 0.8ex 0pt 0pt 0pt; padding-bottom: 1ex;'> > <br>---------[ Received Mail Content ]----------<br> > <br> <b>Subject : </b>Re: [Tcpreplay-users] replaying multiple traces > sequencely<br> > <br> <b>Date : </b>Fri, 23 May 2008 15:42:47 -0700<br> > <br> <b>From : </b>"Aaron Turner" <[EMAIL PROTECTED]><br> > <br> <b>To : </b>"Main forum for tcpreplay" > <[email protected]><br> > <br><br> > <br>On Fri, May 23, 2008 at 3:37 PM, Peter Van Epp <[EMAIL PROTECTED]> wrote: > <br><br>> On Fri, May 23, 2008 at 04:27:19PM -0400, Mohamed Kouki wrote: > <br><br>>> HI list > <br><br>>> <br> > <br><br>>> <br>I'm trying to generate multiple data flows by replying > multiple traces at once > <br><br>>> <br>the goal of my simulation is to replay traces sequencely by > specifying a timer between two consequent traces : > <br><br>>> <br>e.g : 1st flow(trace) : 0ms > <br><br>>> <br> 2nd flow (trace : 10 ms > <br><br>>> <br> 3rd flow(trace) :20 ms > <br><br>>> <br>.................... > <br><br>>> <br>can anyone give me me an idea how to do it using tcpreplay ? > <br><br>>> <br>thanks > <br><br>>> > <br><br>> > <br><br>> I expect you would be easiest to use tcpmerge to combine all > the > <br><br>> trace files in to one and let tcpreplay source that. That will > however arrange > <br><br>> all the connections in time order according to the time stamp in > the pcap > <br><br>> files (which is how tcpmerge merges files). A google search should > find > <br><br>> tcpmerge. > <br><br> > <br><br>Wireshark includes mergecap which does the same thing But yeah, the > <br><br>problem is the timestamps. There's no good way to introduce arbitrary > <br><br>delays between each pcap file. > <br><br> > <br><br>Too bad NetDude doesn't allow you to edit timestamps. :( > <br><br> > <br><br> > <br><br>-- > <br><br>Aaron Turner > <br><br>http://synfin.net/ > <br><br>http://tcpreplay.synfin.net/ - Pcap editing & replay tools for Unix > <br><br>They that can give up essential liberty to obtain a little temporary > <br><br>safety deserve neither liberty nor safety. -- Benjamin Franklin > <br><br> > <br><br>------------------------------------------------------------------------- > <br><br>This SF.net email is sponsored by: Microsoft > <br><br>Defy all challenges. Microsoft(R) Visual Studio 2008. > <br><br>http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ > <br><br>_______________________________________________ > <br><br>Tcpreplay-users mailing list > <br><br>[email protected] > <br><br>https://lists.sourceforge.net/lists/listinfo/tcpreplay-users > <br><br>Support Information: http://tcpreplay.synfin.net/trac/wiki/Support > <br><br></BLOCKQUOTE> >
> ------------------------------------------------------------------------- > This SF.net email is sponsored by: Microsoft > Defy all challenges. Microsoft(R) Visual Studio 2008. > http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ > _______________________________________________ > Tcpreplay-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/tcpreplay-users > Support Information: http://tcpreplay.synfin.net/trac/wiki/Support Some poking indicates netdude does allow time stamp editing in later versions (I'm building one but it looks like it will run out of disk space before finishing though so it looks like an OS reinstall is going to be needed as well :-)). However it does it packet at a time which isn't what you need (they suggest writing a plug in for netdude if you need volume which while a good idea is probably too much work :-)). If you are comfortable in C, then tcpmerge (which unlike wireshark is a small stand alone program) could be modifed to do what you want quite easily. At present it reads and sorts two capture files based on time stamp. What you want is to read one trace file and add a base offest to the time stamp and write it in to the buffer before writing the output file (a fairly trivial change to what it is already doing). That would allow you to offset the start of the second and later pcap files to starting 10 (or 20 or whatever) msec after the final time stamp in the first capture file and write the modified pcap file. Feeding the modified pcap files to tcpreplay (or writing one large pcap file with the modified merge program would work as well) should then do what you want. If you make such a program be sure and send it to this list as well as it may be useful for others :-). Peter Van Epp / Operations and Technical Support Simon Fraser University, Burnaby, B.C. Canada ------------------------------------------------------------------------- This SF.net email is sponsored by: Microsoft Defy all challenges. Microsoft(R) Visual Studio 2008. http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/ _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
