On Tue, Mar 9, 2010 at 10:48 PM, Guanyao Huang <gyhu...@ucdavis.edu> wrote: > Hi > I am tcpreplay some pcap file into ethernet. I find that some > truncated packets are not sent. These pcap files are converted from > some raw IP packets. Using wireshark, it shows [packet size limited > during capture: TCP truncated] > I want to understand what kind of packets can not be tcpreplayed. That > means, the tcpreplay program will filter them out. > Thanks.
Well truncated packets are sent by tcpreplay... they're still truncated though. That generally causes them to be dropped by the receiving host since they're not valid. Basically remember GIGO: garbage in, garbage out. tcpreplay will tell you if one or more packets were not sent in the report at the end. If compiled with --with-debug, you can use debug output to figure out which packets have problems. Generally speaking though the biggest problems you're likely to run into: 1) Packets are too large for the MTU of the interface. You can't send jumbo grams on a NIC which doesn't support them. 2) DLT miss-match. Trying to send packets captured over loopback on a ethernet NIC will result in garbage being sent on the network since the L2 headers are different. Tcprewrite can often help in that case. 3) Not understanding how tcpreplay works. You can't for example send traffic out eth0 and expect your syslog service listening on that interface to actually see the packets. Tcpreplay sends packets *out* the interface and normal TCP/IP applications on the same host can't see the traffic being sent. Hope that helps. -- Aaron Turner http://synfin.net/ http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin "carpe diem quam minimum credula postero" ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
