I should have said definition of state referring to "By utilizing
tcpprep<http://tcpreplay.synfin.net/wiki/tcpprep>cache files,
tcpreplay can split traffic between two interfaces. This allows tcpreplay to
send traffic *through* a device and emulate both client and server sides of
the connection, thereby maintaining state."
http://tcpreplay.synfin.net/wiki/tcpreplay
I'm guessing this maintains the timing/order of the packets based on your
last response, just want to clarify this is for all packets in the capture
after running through tcpprep.
and regarding sequential replay
heres an example for multiple file playback without split traffic
tcpreplay -i eth0 file1 file2 file3 file4
example of single file split traffic
tcpreplay --cachefile=sample.prep --intf1=eth0 --intf2=eth1 sample.pcap
with split traffic, can I do multiple files?
On Mon, Feb 1, 2010 at 12:04 PM, Aaron Turner <[email protected]> wrote:
> On Mon, Feb 1, 2010 at 8:49 AM, Geoff <[email protected]> wrote:
> > Thanks for the response Aaron, tcpreplay is looking like my best option
> so
> > far.
> >
> > Can you provide more details on splitting traffic between interfaces to
> > maintain state - some tools like ixia can only follow a single session
> > (source and dest ip) for tcp only (they modify/correct any missing tcp
> > connection data too though). below you mentioned tcpreplay does 'garbage
> in,
> > garbage out' so can I assume it will maintain state for all packets and
> if
> > so:
> >
> > -what is your definition of 'state' (timing?)
>
> I don't consider tcpreplay "stateful". Tcpreplay at no time reads a
> packet off the wire in order to maintain state of any kind.
>
> > -am I limited to 2 nics?
>
> 1 interface for packet blasting (useful for testing IDS/sniffers) and
> 2 interfaces for testing inline devices (IPS for example).
>
> > -can I still replay files in sequence?
>
> It only plays in sequence.
>
> > -I'd be using tcpprep and splitting on mac with caps 1GB+, which
> > distro/kernel would you suggest?
>
> Easiest to use is a distro which already ships the latest version of
> tcpreplay as an RPM, pkg, etc. tcpreplay/tcpprep works great on any
> recent Linux/*BSD (including OS X) distro.
>
>
> --
> Aaron Turner
> http://synfin.net/
> http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix &
> Windows
> Those who would give up essential Liberty, to purchase a little temporary
> Safety, deserve neither Liberty nor Safety.
> -- Benjamin Franklin
> "carpe diem quam minimum credula postero"
>
>
> ------------------------------------------------------------------------------
> The Planet: dedicated and managed hosting, cloud storage, colocation
> Stay online with enterprise data centers and the best network in the
> business
> Choose flexible plans and management services without long-term contracts
> Personal 24x7 support from experience hosting pros just a phone call away.
> http://p.sf.net/sfu/theplanet-com
> _______________________________________________
> Tcpreplay-users mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
>
------------------------------------------------------------------------------
The Planet: dedicated and managed hosting, cloud storage, colocation
Stay online with enterprise data centers and the best network in the business
Choose flexible plans and management services without long-term contracts
Personal 24x7 support from experience hosting pros just a phone call away.
http://p.sf.net/sfu/theplanet-com
_______________________________________________
Tcpreplay-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
