Split based on address tables. Since tcpreplay only supports primary and
secondary interfaces, two address tables are all that is needed.
If the top of my head ...
Get a packet ...
src on table 1?
yes add dst table 2 (check)
no
src on table 2?
yes add dst table 1 (check)
no add src to table 1 and dst to table 2
There might be more checking, but not much. It is pretty simple. In the end you
will have two tables of addresses that should replicate the point the traffic
was captured.
This will happily sort all packets captured when there are only 2 routing
interfaces involved in that capture. Switch span ports and routers capturing
everything from all interfaces can be a problem, but that traffic won't replay
very well through tcpreplay pri and sec very well any way.
By an odd coincidence I am just about to port the code I used for this to a new
tool in the next couple days.
-MK
________________________________
From: Bennett Todd [mailto:b...@rahul.net]
Sent: Tuesday, September 25, 2012 17:57
To: Main forum for tcpreplay
Subject: Re: [Tcpreplay-users] tcprewrite seed issues
What's bifurcation sort? I don't recall that name.
>From the context, maybe external binary sort?
If so, seems like it could be speedy, with the first pass choosing an initial
partition, then one or more passes of mergesort.
If not, I'd appreciate a pointer to a definition of the algorithm.
------------------------------------------------------------------------------
Live Security Virtual Conference
Exclusive live event will cover all the ways today's security and
threat landscape has changed and how IT managers can respond. Discussions
will include endpoint security, mobile security and the latest in malware
threats. http://www.accelacomm.com/jaw/sfrnl04242012/114/50122263/
_______________________________________________
Tcpreplay-users mailing list
Tcpreplay-users@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/tcpreplay-users
Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
