Hi Aaron, On Sunday 06 August 2006 18:30, Aaron Turner wrote: > > tcpreplay -L -i eth2 dumpfile > > Uh, why are you using the -L flag? As the man page says, "bad things > may happen when you use it". It's really only there because > apparently someone had a corrupted or badly generated pcap file and > needed a work around. I've never seen tcpdump have that problem.
Hmhm. I tried the -L flag, because tcpdump reports errors when i don't use it. The error messages look like this: 19:51:12.905157 IP truncated-ip - 66 bytes missing! 10.0.2.2.32769 > 10.0.2.1.4711: UDP, length 120 When i use the -L flag, tcpdump shows 19:53:36.401006 IP 10.0.2.2.32769 > 10.0.2.1.4711: UDP, length 120 And that's what i would expect :) > > Tcpdump on PC2 shows me, that the traffic arrives as expected. > > Do you still see the packets in tcpdump if you use the -p flag? If > not, then your MAC address has changed. Same result with -p > I'll assume of course that > the IP addresses are the same. Sure :) > > I then tried to put an application on PC2 that listens on port 4711. But > > that application does not get any data from the replayed traffic. > > Could be a bunch of reasons for that. Is IP Tables or other firewall > running on PC2? There's no firewall involved. > Is the traffic valid for that application? Have you > verified that that the application on port 4711 can get non-replayed > traffic? Without knowing what application your running and a copy of > the pcap, it's pretty hard to help much more. The application is self-written and works on IPFIX [1] data. I recorded that IPFIX traffic and i'm now trying to replay it. Everything works fine with live-traffic. I don't think it's a problem with my app, because no data is passed to it when tcpreplay runs (recv() on the UDP socket does not return) I put the dump on my webspace, because it's too big to send it by mail (about 1 mb) http://www.lobraun.de/dump.tar.bz2 [1] http://www.ietf.org/internet-drafts/draft-ietf-ipfix-protocol-22.txt Best regards, Lothar ------------------------------------------------------------------------- Take Surveys. Earn Cash. Influence the Future of IT Join SourceForge.net's Techsay panel and you'll get the chance to share your opinions on IT & business topics through brief surveys -- and earn cash http://www.techsay.com/default.php?page=join.php&p=sourceforge&CID=DEVDEV _______________________________________________ Tcpreplay-users mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
