I think there is some confusion what Tcpreplay does. When tcpreplay sends traffic, it has to strip off the pcap header from each packet and so the original timestamp is never sent on the wire. If you're referring to the TCP Timestamp Option (rfc 1323), then those values are sent as they were originally captured.
-- Aaron Turner http://synfin.net/ Twitter: @synfinatic Those who would give up essential Liberty, to purchase a little temporary Safety, deserve neither Liberty nor Safety. -- Benjamin Franklin On Sun, Jul 12, 2015 at 8:28 PM, Hashem Alaidaros <aidaros....@gmail.com> wrote: > Hi, I'm Aid, > I run tcpreplay in one machine, in another machine I run netflow generation > that convert packet into flows. First I ran the netflow offline (reading > from pcap in the same machine), it seems that the netflow generate flows > with original flow duration (duration= last packet time - first packet time) > in reasonable values. > > Secondly, I ran the same pcap but this time with tcpreplay machine to replay > the traffic to a netwflow machine through switch. Netflow generate the flows > but most of flow durations are zeros, which mean the timestamp is changed. > > Is it possible to run tcpreplay in the original timestamp? > > Regards > > ------------------------------------------------------------------------------ > Don't Limit Your Business. Reach for the Cloud. > GigeNET's Cloud Solutions provide you with the tools and support that > you need to offload your IT needs and focus on growing your business. > Configured For All Businesses. Start Your Cloud Today. > https://www.gigenetcloud.com/ > _______________________________________________ > Tcpreplay-users mailing list > Tcpreplay-users@lists.sourceforge.net > https://lists.sourceforge.net/lists/listinfo/tcpreplay-users > Support Information: http://tcpreplay.synfin.net/trac/wiki/Support ------------------------------------------------------------------------------ Don't Limit Your Business. Reach for the Cloud. GigeNET's Cloud Solutions provide you with the tools and support that you need to offload your IT needs and focus on growing your business. Configured For All Businesses. Start Your Cloud Today. https://www.gigenetcloud.com/ _______________________________________________ Tcpreplay-users mailing list Tcpreplay-users@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/tcpreplay-users Support Information: http://tcpreplay.synfin.net/trac/wiki/Support
