Hi all, I am using tcpreplay to play a pcap file at the original speed it was recorded and I'm having an interesting issue. Actually I don't know if it is a real issue or an expected behaviour, and that is why I'm writing to the mail list.
This is the description: I play the pcap file through one network interface. After some time playing (can't be sure of the actual time) the network interface is gone for any other requests, that is, the file is being played, but if I tried to access the server, ping, ssh or whatever, I got no answers. All the ping packets I send are lost, so I can't stop tcpreplay and it keeps on running until the file is finished. An easy way to fix MY _problem_ would be to have an extra network interface to access the machine while the other one is used to pump the file, but still I would like to know if this behaviour is expected or it is something strange that is happening because of the way tcpreplay tries to simulate the real speed in which the file was recorded. I'm sending the file through no routers. The two hosts are in the same network. And I'm positive tcpplayer is sending the file because the other end is reachable and it is receiving the data as expected. No data is missing in the receiver. This is the way I generated the files pcap: # I want all the traffic from the network 10. to be pumped into the destination ip address tcpprep --regex="10\..*" --pcap=orig.pcap --cachefile=cache.cache # 172.30.2.65 is the origin and 172.30.2.60 the destination tcprewrite --endpoints=172.30.2.65:172.30.2.60 --cachefile=cache.cache --infile=orig.pcap --outfile=temp.pcap --skipbroadcast # 00:00:00:00:00:AA and 00:00:00:00:00:BB are the destination and source mac addresses tcprewrite --enet-dmac=00:00:00:00:00:AA --enet-smac=00:00:00:00:00:BB --cachefile=cache.cache --infile=temp.pcap --outfile=to_send.pcap # and this is the offending command sudo tcpreplay --intf1=eth0 --cachefile=cache.cache to_send.pcap I tried this very same commands using: tcpreplay version 3.3.1 under ubuntu desktop 8.10 in a 2Gb intel core duo (2 usable processors) tcpreplay version 3.0.1 under catapulta linux (http://www.catapulta.org/). From their webpage, Catapulta is an Ubuntu-based server platform that is designed and packaged specifically for high-performance network monitoring applications using commodity hardware. This is a server 32Gb RAM, intel 2 quad core (2x4 processors) In both cases the file was played at the expected speed (2.5 Mbits/s aprox.) but after some time the network interface is not reachable (in both cases) Then I compiled pcapplayer 3.4.2 (with pcap 0.9.5) in that catapulta linux, and played the file. This time the network took more time to be down and surprisingly tcpreplay is playing the file 10 times slower than before, so the network is taking 10 times more to come back. The file is a 10 minutes file so all this issue wasn't a big deal until now, when I have to wait for 100 minutes instead of 10. Anyway, I got two questions: Is a normal behavior that the network interface is gone while I play the file or there is something I'm not doing fine when I try to play the file? why is tcpplayer 3.4.2 is playing the file 10 times slower than 3.0.1 under the catapulta linux box? About the hardware, all I can get now is that the ubuntu desktop 8.10 network card is "00:19.0 Ethernet controller: Intel Corporation 82567LM-3 Gigabit Network Connection" (I have no access to those machines at the moment). If anyone needs more information about the hardware I'll be back to you as soon as I can, but I hope some questions can be answered roughly in the meantime, I'm dying here out of curiosity!! Thanks in advance for any help, Faustino ------------------------------------------------------------------------------ OpenSolaris 2009.06 is a cutting edge operating system for enterprises looking to deploy the next generation of Solaris that includes the latest innovations from Sun and the OpenSource community. Download a copy and enjoy capabilities such as Networking, Storage and Virtualization. Go to: http://p.sf.net/sfu/opensolaris-get _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
