Sounds like a bug. Can you send me a small pcap with those packets and I'll debug it and see if I can create a patch.
On Thu, Sep 27, 2012 at 2:28 PM, Gareth Baker <gareth.bake...@gmail.com> wrote: > Hi, > > > > I have taken a bunch of previously captured pcap files and merged them > together to create a large (1GB) capture file. I would like to edit this > capture file to make it look like they all came from the client IP address > using tcprewrite. > > > > All of the conversations in the large pcap have only of their IP addresses > in the 192.168.xxx.xxx subnet so I tried to run the following: > > > > Tcprewrite –pnat=192.168.0.0/16:10.0.0.1/32 –infile=Testing.pcap > –outfile=OneClient.pcap –skipbroadcast > > > > This seemed to work for the most part but it ended up missing two of the IP > addresses that I was hoping to modify. Below is a snippet of my > conversation statistics before and after: > > > > Before > > > > ================================================================================ > > IPv4 Conversations > > Filter:<No Filter> > > | <- | | -> > | | Total | > > | Frames Bytes | | Frames > Bytes | | Frames Bytes | > > 209.226.175.83 <-> 192.168.80.103 92235 5151055 169715 > 132028195 261950 137179250 > > 216.58.97.34 <-> 192.168.80.103 111437 142972270 75553 > 4678566 186990 147650836 > > 192.168.62.230 <-> 74.125.110.158 88000 130416320 43080 > 2349900 131080 132766220 > > 192.168.62.45 <-> 64.15.119.92 65334 98883570 38066 > 2200342 103400 101083912 > > 192.168.62.163 <-> 192.168.62.60 43035 31754012 55262 > 56451399 98297 88205411 > > 192.168.62.224 <-> 74.125.110.217 49184 74274078 25574 > 1436832 74758 75710910 > > 192.168.62.224 <-> 74.125.110.93 38164 57607074 20334 > 1150750 58498 58757824 > > 192.168.62.230 <-> 74.125.110.213 30600 45064296 14868 > 816990 45468 45881286 > > 192.168.62.163 <-> 83.240.29.68 22275 32485797 14535 > 867096 36810 33352893 > > 192.168.62.163 <-> 64.122.87.92 16542 22760253 11466 > 733977 28008 23494230 > > 192.168.62.163 <-> 72.14.205.83 9756 2339430 13398 > 17106780 23154 19446210 > > 212.58.227.75 <-> 192.168.62.163 8374 1809021 14457 > 14208624 22831 16017645 > > 192.168.62.163 <-> 72.14.205.19 13044 11981352 8676 > 3089418 21720 15070770 > > > > After > > > > ================================================================================ > > IPv4 Conversations > > Filter:<No Filter> > > | <- | | -> > | | Total | > > | Frames Bytes | | Frames > Bytes | | Frames Bytes | > > 209.226.175.83 <-> 192.168.0.1 92235 5151055 169715 > 132028195 261950 137179250 > > 216.58.97.34 <-> 192.168.0.1 111437 142972270 75553 > 4678566 186990 147650836 > > 192.168.62.230 <-> 74.125.110.158 88000 130416320 43080 > 2349900 131080 132766220 > > 192.168.0.1 <-> 64.15.119.92 65334 98883570 38066 > 2200342 103400 101083912 > > 192.168.0.1 <-> 192.168.0.1 98297 88205411 0 > 0 98297 88205411 > > 192.168.62.224 <-> 74.125.110.217 49184 74274078 25574 > 1436832 74758 75710910 > > 192.168.62.224 <-> 74.125.110.93 38164 57607074 20334 > 1150750 58498 58757824 > > 192.168.62.230 <-> 74.125.110.213 30600 45064296 14868 > 816990 45468 45881286 > > 192.168.0.1 <-> 83.240.29.68 22275 32485797 14535 > 867096 36810 33352893 > > 192.168.0.1 <-> 64.122.87.92 16542 22760253 11466 > 733977 28008 23494230 > > 192.168.0.1 <-> 72.14.205.83 9756 2339430 13398 > 17106780 23154 19446210 > > 212.58.227.75 <-> 192.168.0.1 8374 1809021 14457 > 14208624 22831 16017645 > > 192.168.0.1 <-> 72.14.205.19 13044 11981352 8676 > 3089418 21720 15070770 > > > > It seems like it missed every 192.168.62.230 and 192.168.62.224 during the > rewrite but it managed to get all of the other ones that I wanted. Am I > missing something with the pnat option that I specified? > > > > Any help would be appreciated, > > Gareth > > > ------------------------------------------------------------------------------ > Everyone hates slow websites. So do we. > Make your web apps faster with AppDynamics > Download AppDynamics Lite for free today: > http://ad.doubleclick.net/clk;258768047;13503038;j? > http://info.appdynamics.com/FreeJavaPerformanceDownload.html > _______________________________________________ > Tcpreplay-users mailing list > Tcpreplay-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/tcpreplay-users > Support Information: http://tcpreplay.synfin.net/trac/wiki/Support -- Aaron Turner http://synfin.net/ Twitter: @synfinatic http://tcpreplay.synfin.net/ - Pcap editing and replay tools for Unix & Windows Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin "carpe diem quam minimum credula postero" ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://ad.doubleclick.net/clk;258768047;13503038;j? http://info.appdynamics.com/FreeJavaPerformanceDownload.html _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
