Hi Jens! The 3379Mbps is pretty typical for an interface without link. I don't know of a cross-platform API for easily detecting link up and writing packets to a down interface does not report an error. But the kernel knows the interface is down and never processes the packet so writing the packets is *very* fast- often much faster then the NIC itself supports. Reality is it's something I probably could detect if I did more work, but hasn't been a priority to put in the effort.
As for your second question, tcpreplay never reads packets on the wire- even in dual-nic mode. I personally wouldn't use tcpreplay to test your IPS/IDS is handling traffic correctly, but rather to simulate load on the network and then use another tool to test that your IPS/IDS is working properly. Hope that helps. -Aaron On Wed, Dec 7, 2011 at 11:53 AM, Jens Kuehnel <tcprep...@jens.kuehnel.org> wrote: > Hi, > > even after reading almost the whole webpage/docu I still have a couple > of questions about tcpreplay. > > I was able to compile it, got a tcpdump dump, used tcpprep, and was > setting up my network (dual-card mode). Everything went very smoothly. > I started tcpreplay --topspeed .... but forgot to plugin the network cable. > > With the result of 3379 Mbps on my two Gigabit cards. > Same setup with network cable 1079 Mbps > > OS: Debian 6.0.3 kernel 2.6.32-5 > CPU: Intel E2200 RAM:4GB > network card: 2Ports out of a 4 Port Intel 82571EB PCIe (2.5GB/s) 4x > > On my MacOS BookPro8,3 I get 330MBps with cable and 992MBps without cable. > > My questions are: > > Do I understand that correctly that tcpreplay dumps the data (sorted by > server/client) as fast as possible on to the cable without caring about > the result. > > The change between single and dual-nic is only the distribution of the > data send out? > > The "returning" data (in a dual-port setup) is not analyzed at all? > The tcp sessions are not synced between the two network cards? Can it > happen that a syn-ack is then from on card before the syn is send from > the other card? > > But with all this, how can you be sure that the IPS is not only droping > the package because of an overrun queue or any other problem? > > I'm trying to measure a transparent IPS just like: > http://tcpreplay.synfin.net/wiki/usage > #PassingTrafficThroughanIPSTransparentDevice > > I'm trying to use tcpreplay to do some hardware sizing to get a feeling > what kind of hardware can handle what kind of load. We use iperf at the > moment. I know that that is not a good option, but was the first thing > that came to mind, was simple to setup and worked immediately. > > Greetings from Germany > Jens -- Aaron Turner http://synfin.net/ Twitter: @synfinatic http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin "carpe diem quam minimum credula postero" ------------------------------------------------------------------------------ Cloud Services Checklist: Pricing and Packaging Optimization This white paper is intended to serve as a reference, checklist and point of discussion for anyone considering optimizing the pricing and packaging model of a cloud services business. Read Now! http://www.accelacomm.com/jaw/sfnl/114/51491232/ _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
