Thank you very much for such a detailed explanation. Yes, yesterday right after the email I though it is probably that the packets sent but dropped by end host. Even worse, it might be dropped by the switch if it has problem. I will double check and confirm what happens.
On Wed, Mar 10, 2010 at 9:59 AM, Aaron Turner <[email protected]> wrote: > On Tue, Mar 9, 2010 at 10:48 PM, Guanyao Huang <[email protected]> wrote: >> Hi >> I am tcpreplay some pcap file into ethernet. I find that some >> truncated packets are not sent. These pcap files are converted from >> some raw IP packets. Using wireshark, it shows [packet size limited >> during capture: TCP truncated] >> I want to understand what kind of packets can not be tcpreplayed. That >> means, the tcpreplay program will filter them out. >> Thanks. > > Well truncated packets are sent by tcpreplay... they're still > truncated though. That generally causes them to be dropped by the > receiving host since they're not valid. > > Basically remember GIGO: garbage in, garbage out. > > tcpreplay will tell you if one or more packets were not sent in the > report at the end. If compiled with --with-debug, you can use debug > output to figure out which packets have problems. > > Generally speaking though the biggest problems you're likely to run into: > > 1) Packets are too large for the MTU of the interface. You can't send > jumbo grams on a NIC which doesn't support them. > > 2) DLT miss-match. Trying to send packets captured over loopback on a > ethernet NIC will result in garbage being sent on the network since > the L2 headers are different. Tcprewrite can often help in that case. > > 3) Not understanding how tcpreplay works. You can't for example send > traffic out eth0 and expect your syslog service listening on that > interface to actually see the packets. Tcpreplay sends packets *out* > the interface and normal TCP/IP applications on the same host can't > see the traffic being sent. > > Hope that helps. > > -- > Aaron Turner > http://synfin.net/ > http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & > Windows > Those who would give up essential Liberty, to purchase a little temporary > Safety, deserve neither Liberty nor Safety. > -- Benjamin Franklin > "carpe diem quam minimum credula postero" > > ------------------------------------------------------------------------------ > Download Intel® Parallel Studio Eval > Try the new software tools for yourself. Speed compiling, find bugs > proactively, and fine-tune applications for parallel performance. > See why Intel Parallel Studio got high marks during beta. > http://p.sf.net/sfu/intel-sw-dev > _______________________________________________ > Tcpreplay-users mailing list > [email protected] > https://lists.sourceforge.net/lists/listinfo/tcpreplay-users > Support Information: http://tcpreplay.synfin.net/trac/wiki/Support > ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
