this command changes mac adresses of your pcap file (resulting in the
output file). Originally your pcap file (input file) contains another mac
adresses: the ones that corresponds to the origin cards used to capture the
trafic. Then as you will replay that pcap file in another devices (thus
another cards) dmac should change !!
Actually when the server gets the packet, at first it cheks the associated
dmac if it corresponds to the mac adress of the Nic card that captured the
paquet then it goes up to the IP level (These are basics of OSI model).
Then if the associated mac adress is wrong: the paquet won't be accepted.
Well concerning the virtual box I really don't know... May be Aaron masters
it better !!
It would be better if you use Linux independantly..
In fact I remember I used tcpreplay to replay a capture between 2 devices
'on Linux based system and the router was an OpenBSD.
On Thu, Dec 15, 2011 at 8:08 PM, Prosiac Akin <cramped_ga...@yahoo.com>wrote:
> i followed your instructions with the commands mentioned below
> tcprewrite --enet-dmac=00:55:22:AF:C6:37 --enet-smac=00:44:66:FC:29:AF
> --infile=input.pcap --outfile=output.pcap
>
> *tcpreplay --intf1=eth0 "output.pcap"*
> *
> *
> *no *error was seeen with this command, however, *i ca*nnot see the
> packets through wireshark.
> Is it because i am doing this all in Vmware platform??? ( I am using the
> virtual mac address for smac taken from ubuntu installed in vmware). If
> yes, what could be its possible solution???
>
> *(I was wondering about its usage. can you please clarify me what this
> command is actually doing. Why do we need that --outfile??? Even if we give
> the same pcap name as input.pcap, the command works fine. So i am really
> confused)*
>
> *
> *
>
>
> ------------------------------
> *From:* Ali Gouta <ali.go...@gmail.com>
> *To:* Main forum for tcpreplay <tcpreplay-users@lists.sourceforge.net>
> *Sent:* Thursday, December 15, 2011 6:41 PM
>
> *Subject:* Re: [Tcpreplay-users] sending pcap files from one computer to
> another using tcpreplay
>
> tcprewrite --enet-dmac=00:55:22:AF:C6:37 --enet-smac=00:44:66:FC:29:AF
> --infile=input.pcap --outfile=output.pcap
>
> If the targeted card has the adress "00:55:22:AF:C6:37" and the one you
> are sending has the adress "00:44:66:FC:29:AF" then you have to type this
> command, then use tcpreplay as following:
> *tcpreplay --intf1=eth0 "output.pcap"*
> *
> *
> output.pcap is the generated file of the command tcprewrite.
>
> Now if you use tshark/tcpdump/wireshark (I recommand REALLY tshark) on the
> other device (the one whose mac adress "00:55:22:AF:C6:37") you will see
> packets getting in. (Then they will be dropped as after checking routing
> table they won't find the next hope!!!)
>
> Good luck
>
> On Thu, Dec 15, 2011 at 6:18 PM, Prosiac Akin <cramped_ga...@yahoo.com>wrote:
>
> Hello there,
>
> I am not dealing with Vlans. Its the simple network with LANS (same
> network group). For my case, i don't want to send files through 2
> interfaces,
> one is enough and for my currrent use, one directional traffic is also OK.
> FIrst i need to check one directional and then i will check bidirectional.
> But even fror one directional traffic, what command should i use??
>
> sudo tcprewrite --endpoints=192.168.234.139:192.168.15.215
> --cachefile=dhcp.cache --infile=dhcp.pcap --outfile=dhcp.pcap
> --skipbroadcast ??
> without the one with red marks
>
> or??
>
> tcprewrite --enet-dmac=00:55:22:AF:C6:37 --enet-smac=00:44:66:FC:29:AF
> --infile=input.pcap --outfile=output.pcap ???
>
>
>
>
> ------------------------------
> *From:* Ali Gouta <ali.go...@gmail.com>
> *To:* Main forum for tcpreplay <tcpreplay-users@lists.sourceforge.net>
> *Sent:* Thursday, December 15, 2011 6:11 PM
> *Subject:* Re: [Tcpreplay-users] sending pcap files from one computer to
> another using tcpreplay
>
> You need at first to change mac adresses of the trace or pcap file you are
> replaying (use tcprewrite) to the source and destination of your cards
> (ifconfig to know them).
> Chcek if you are dealing with Vlans !!!
> Cache file you will need if you want to seperate downlink from the uplink
> :means that you send your pcap file from 2 interfaces not only one !!!
> Your use case: sending the trace file from 1 pc to another means you won't
> need the cache file( or you can use it but in this case you will send only
> one direction not both)
>
> Good luck
> On Thu, Dec 15, 2011 at 5:53 PM, Prosiac Akin <cramped_ga...@yahoo.com>wrote:
>
> hello all,
>
> i am trying to send the pcap file from one pc to another
> while going through the tcpreplay website, i found
>
> ** tcprewrite --endpoints=10.10.1.1:10.10.1.2 --cachefile=input.cache
> --infile=input.pcap --outfile=output.pcap --skipbroadcast
>
> does this endpoints means (two computers)???
>
> If it is for the two pcs, i tried to issue that command
> sudo tcprewrite --endpoints=192.168.234.139:192.168.15.215
> --cachefile=dhcp.cache --infile=dhcp.pcap --outfile=dhcp.pcap
> --skipbroadcast
>
> where 192.168.234.139 is the ip of the computer which is sending the pcap
> file and 192.168.15.215 is the ip of the computer which i am destined to.
>
> But i got this error
> Fatal Error: unable to open dhcp.cache:No such file or directory
>
> I am not aware how to create that cachefile for this process. and i don't
> know whether i am following the right process or not.
>
> Could you please help/suggest the method of doing so..
>
>
>
> ------------------------------------------------------------------------------
> 10 Tips for Better Server Consolidation
> Server virtualization is being driven by many needs.
> But none more important than the need to reduce IT complexity
> while improving strategic productivity. Learn More!
> http://www.accelacomm.com/jaw/sdnl/114/51507609/
> _______________________________________________
> Tcpreplay-users mailing list
> Tcpreplay-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
>
>
>
>
> ------------------------------------------------------------------------------
> 10 Tips for Better Server Consolidation
> Server virtualization is being driven by many needs.
> But none more important than the need to reduce IT complexity
> while improving strategic productivity. Learn More!
> http://www.accelacomm.com/jaw/sdnl/114/51507609/
> _______________________________________________
> Tcpreplay-users mailing list
> Tcpreplay-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
>
>
>
> ------------------------------------------------------------------------------
> 10 Tips for Better Server Consolidation
> Server virtualization is being driven by many needs.
> But none more important than the need to reduce IT complexity
> while improving strategic productivity. Learn More!
> http://www.accelacomm.com/jaw/sdnl/114/51507609/
> _______________________________________________
> Tcpreplay-users mailing list
> Tcpreplay-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
>
>
>
>
> ------------------------------------------------------------------------------
> 10 Tips for Better Server Consolidation
> Server virtualization is being driven by many needs.
> But none more important than the need to reduce IT complexity
> while improving strategic productivity. Learn More!
> http://www.accelacomm.com/jaw/sdnl/114/51507609/
> _______________________________________________
> Tcpreplay-users mailing list
> Tcpreplay-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
>
>
>
> ------------------------------------------------------------------------------
> 10 Tips for Better Server Consolidation
> Server virtualization is being driven by many needs.
> But none more important than the need to reduce IT complexity
> while improving strategic productivity. Learn More!
> http://www.accelacomm.com/jaw/sdnl/114/51507609/
> _______________________________________________
> Tcpreplay-users mailing list
> Tcpreplay-users@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
> Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
>
------------------------------------------------------------------------------
10 Tips for Better Server Consolidation
Server virtualization is being driven by many needs.
But none more important than the need to reduce IT complexity
while improving strategic productivity. Learn More!
http://www.accelacomm.com/jaw/sdnl/114/51507609/
_______________________________________________
Tcpreplay-users mailing list
Tcpreplay-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
