I found that the truncated packets are also sent, but they are captured as [Malformed packet] through tcpdump.
On Wed, Mar 10, 2010 at 11:06 AM, Guanyao Huang <gyhu...@ucdavis.edu> wrote: > Thank you very much for such a detailed explanation. > Yes, yesterday right after the email I though it is probably that the > packets sent but dropped by end host. Even worse, it might be dropped > by the switch if it has problem. I will double check and confirm what > happens. > > > On Wed, Mar 10, 2010 at 9:59 AM, Aaron Turner <synfina...@gmail.com> wrote: >> On Tue, Mar 9, 2010 at 10:48 PM, Guanyao Huang <gyhu...@ucdavis.edu> wrote: >>> Hi >>> I am tcpreplay some pcap file into ethernet. I find that some >>> truncated packets are not sent. These pcap files are converted from >>> some raw IP packets. Using wireshark, it shows [packet size limited >>> during capture: TCP truncated] >>> I want to understand what kind of packets can not be tcpreplayed. That >>> means, the tcpreplay program will filter them out. >>> Thanks. >> >> Well truncated packets are sent by tcpreplay... they're still >> truncated though. That generally causes them to be dropped by the >> receiving host since they're not valid. >> >> Basically remember GIGO: garbage in, garbage out. >> >> tcpreplay will tell you if one or more packets were not sent in the >> report at the end. If compiled with --with-debug, you can use debug >> output to figure out which packets have problems. >> >> Generally speaking though the biggest problems you're likely to run into: >> >> 1) Packets are too large for the MTU of the interface. You can't send >> jumbo grams on a NIC which doesn't support them. >> >> 2) DLT miss-match. Trying to send packets captured over loopback on a >> ethernet NIC will result in garbage being sent on the network since >> the L2 headers are different. Tcprewrite can often help in that case. >> >> 3) Not understanding how tcpreplay works. You can't for example send >> traffic out eth0 and expect your syslog service listening on that >> interface to actually see the packets. Tcpreplay sends packets *out* >> the interface and normal TCP/IP applications on the same host can't >> see the traffic being sent. >> >> Hope that helps. >> >> -- >> Aaron Turner >> http://synfin.net/ >> http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & >> Windows >> Those who would give up essential Liberty, to purchase a little temporary >> Safety, deserve neither Liberty nor Safety. >> -- Benjamin Franklin >> "carpe diem quam minimum credula postero" >> >> ------------------------------------------------------------------------------ >> Download Intel® Parallel Studio Eval >> Try the new software tools for yourself. Speed compiling, find bugs >> proactively, and fine-tune applications for parallel performance. >> See why Intel Parallel Studio got high marks during beta. >> http://p.sf.net/sfu/intel-sw-dev >> _______________________________________________ >> Tcpreplay-users mailing list >> Tcpreplay-users@lists.sourceforge.net >> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users >> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support >> > ------------------------------------------------------------------------------ Download Intel® Parallel Studio Eval Try the new software tools for yourself. Speed compiling, find bugs proactively, and fine-tune applications for parallel performance. See why Intel Parallel Studio got high marks during beta. http://p.sf.net/sfu/intel-sw-dev _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
