On Mon, Dec 19, 2011 at 11:26 PM, Jens Kuehnel <tcprep...@jens.kuehnel.org> wrote: > Hi Aaron, Hi .*, > > thanks for you explanations. > I did some more testing and I don't understand what the use cases for > tcpreplay are? > > I'm testing my IDS which runs in inline mode and bridging. But tcpreplay > shows no difference if I activate the IDS or simply passing the data > through as a pure bridge. > > When I do the same test with iperf the performance drops from 900MBit/s > to 120 MBit/s, but no change with tcpreplay. > > I don't really care if my IDS reacts correctly to every attack, but I > need only a rough figure what kind of traffic different machines can handle.
Tcpreplay is a traffic generator more for IDS/IPS detection of attacks or for generating "real world" background traffic rather then computer generated pseudo-random traffic which looks nothing like the real world. It does not "measure" your performance or detection capabilities. Instead you should examine your IDS/IPS logs for detection rates and use a other tools for measuring things like packet loss and latency. Hope that clarifies things. -- Aaron Turner http://synfin.net/ Twitter: @synfinatic http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin "carpe diem quam minimum credula postero" ------------------------------------------------------------------------------ Write once. Port to many. Get the SDK and tools to simplify cross-platform app development. Create new or port existing apps to sell to consumers worldwide. Explore the Intel AppUpSM program developer opportunity. appdeveloper.intel.com/join http://p.sf.net/sfu/intel-appdev _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
