Tcpreplay

Edit and replay captured network traffic — at the original timing, a fixed rate, or as fast as the hardware allows.

Get started Browse the tools

Tcpreplay is a suite of GPLv3 utilities for editing and replaying network traffic that was previously captured by tools like tcpdump and Wireshark. Take a .pcap file, optionally rewrite its Layer 2–4 headers, and push it back onto the wire.

It is used by firewall, IDS/IPS, NetFlow and other networking vendors, enterprises, universities, and open-source projects to test and tune devices against realistic, repeatable traffic.

• New here?

  ---

  Install the suite and replay your first capture in five minutes.

  Quickstart

• The tools

  ---

  Six focused command-line tools. Learn what each is for and how to drive it.

  Tools overview

• How-to guides

  ---

  Task-oriented recipes: line-rate testing, header rewriting, live TCP replay.

  Guides

• Concepts

  ---

  The mental model behind the suite: the replay pipeline, timing, DLT plugins.

  Concepts

What can you do with it?

• Replay traffic

  Send a capture back onto the network with tcpreplay — preserving the original inter-packet timing, or at a target rate in packets/sec or Mbps, or flat-out at line rate.

• Rewrite packets

  Rewrite MAC/IP addresses, ports, VLAN tags, checksums and more with tcprewrite, without touching the payload semantics — ideal for retargeting a capture at your lab.

• Split client/server

  Classify each packet as client- or server-side with tcpprep, so a single capture can drive a two-NIC in-line test through a device under test.

• Replay to a live server

  Replay a captured TCP session against a real server with tcpliveplay, exercising the full stack up to the application — not just Layer 2.

How the pieces fit together

A capture goes in on the left and packets come out on the wire. tcpprep and tcprewrite are optional pre-processing stages — use either, both, or neither.

flowchart LR
    PCAP[".pcap capture"]
    PREP["tcpprep"]
    CACHE["cache file"]
    REW["tcprewrite"]
    EDITED["edited .pcap"]
    REP["tcpreplay"]
    WIRE(["network"])

    PCAP --> PREP --> CACHE --> REP
    PCAP --> REW --> EDITED --> REP
    PCAP --> REP
    REP --> WIRE

    classDef stage fill:none,stroke:#00897b,stroke-width:2px;
    classDef out fill:none,stroke:#00bfa5,stroke-width:2px;
    class PCAP,PREP,CACHE,REW,EDITED,REP stage;
    class WIRE out;

The suite at a glance

Tool	One-liner
tcpreplay	Replay pcap files onto the network at arbitrary speeds.
tcpreplay-edit	Replay while rewriting headers in one pass (tcpreplay + tcprewrite).
tcprewrite	Rewrite Layer 2–4 headers in a pcap (front end to libtcpedit).
tcpprep	Pre-process a pcap into a cache file, classifying packets as client/server.
tcpbridge	Bridge two network segments, applying tcprewrite logic in flight.
tcpliveplay	Replay a captured TCP session against a live server (full stack).
tcpcapinfo	Inspect and debug the raw structure of a pcap file.

tcpreplay vs tcpreplay-edit

When built with editing support, you also get tcpreplay-edit, which is tcpreplay with all of tcprewrite's rewriting options folded in — so you can rewrite headers and replay in a single pass. Plain tcpreplay is the lean, edit-free replay engine.

Why it exists

Real network traffic is messy, bursty, and hard to reproduce on demand. Tcpreplay lets you capture a slice of it once and replay it deterministically as often as you like — the same packets, the same timing, at whatever speed your test calls for. That makes it possible to benchmark throughput, reproduce a bug, regression-test a firewall rule, or drive a NetFlow appliance to its limits, all from a saved .pcap.

Get started Browse the tools