Tcpreplay
A suite of free, Open Source utilities for editing and replaying network traffic previously captured with tcpdump or Wireshark. Classify traffic as client or server, rewrite Layer 2–4 headers, and replay it back onto the network through switches, routers, firewalls, NIDS/IPS and IP Flow/NetFlow appliances — at anywhere from a trickle up to full wire rate.
Quick start
$ tar xf tcpreplay-*.tar.xz && cd tcpreplay-*
$ ./configure && make && sudo make install
$ sudo tcpreplay -i eth0 test.pcapBuilding from a git checkout instead? See the Installation guide for both the autotools and CMake build paths.
Example — sending line-rate flows to an IP Flow / NetFlow appliance
# tcpreplay -i eth7 --io-uring -tK --loop 5000 --unique-ip smallFlows.pcap
File Cache is enabled
Actual: 71305000 packets (46082655000 bytes) sent in 38.05 seconds.
Rated: 1194330011.6 Bps, 9554.64 Mbps, 1848020.72 pps
Flows: 6045000 flows, 156669.03 fps, 71215000 flow packets, 90000 non-flow
Statistics for network device: eth7
Attempted packets: 71305000
Successful packets: 71305000
Failed packets: 0
Truncated packets: 0
Retried packets (ENOBUFS): 0
Retried packets (EAGAIN): 0Sending traffic as fast as possible
If the default socket path isn't hitting the rate you need, Tcpreplay has three progressively lower-overhead ways to push packets straight to the NIC. Try them roughly in this order:
1. io_uring
Linux only, needs liburing and a recent kernel. Asynchronous,
batched sends through an io_uring submission queue — the lowest setup cost
of the three, no special NIC driver required. --io-uring
2. AF_XDP
Linux only, needs libxdp/libbpf and an eBPF-capable
driver. Bypasses the kernel network stack for near line-rate throughput without
patching drivers. --xdp
3. netmap
Linux/BSD, needs netmap-patched network drivers. The most invasive option and
disruptive to other traffic on that NIC while active, but still the highest
ceiling on supported hardware. --netmap
See the How To and FAQ pages for setup details and tuning tips for each.
The suite
tcpreplay/tcpreplay-edit— replay pcap files at arbitrary speeds onto the network, optionally editing packets on the flytcpliveplay— replay a captured TCP session against a live server that will actually respond to ittcpprep— pre-process a pcap into a client/server cache file used by tcpreplay and tcprewritetcprewrite— rewrite Layer 2/3/4 headers in a pcap filetcpbridge— bridge two network segments using tcprewrite's rewriting logictcpcapinfo— raw pcap file decoder and debugger
See Products for details, or jump straight to a man page:
Learn more
Overview
What Tcpreplay does and why, with real-world examples.
How To
Step-by-step performance testing walkthroughs.
Usage Examples
Common tcpprep → tcprewrite → tcpreplay workflows.
FAQ
Answers to the questions that come up again and again.
Embedding libtcpreplay
Drive the replay engine from your own C program.
Embedding libtcpedit
Drive the packet-rewriting engine from your own C program.
Sample Captures
Ready-made pcap files for flow and performance testing.
Support
Where to ask questions and how to file a good bug report.
Contributing
Fork, branch, and send a pull request.