1

I've captured udp traffic to a pcap file. When replaying with tcpreplay-edit, I'd like to shorten all pauses (where there is no udp traffic at all) to x seconds max. tcpreplay-edit only has a global speed multiplier.

Is there any automated way to do this? Ideally without resorting to guis like wireshark, but any solution is welcome.

2 Answers 2

2

I'm still curious if there is a way, but in the meantime I found a workaround for the case at hand by using one of the following parameters of tcpreplay-edit:

-p number, --pps=number Replay packets at a given packets/sec.

-M string, --mbps=string Replay packets at a given Mbps.

-t, --topspeed Replay packets as fast as possible.

0

With a script? Sure. Without a script? Well, kinda.

You can use editcap's -S (strict time adjustment) option with a negative value to adjust the time of all packets to the previous packet's timestamp plus the -S value. A positive value for -S will only adjust the timestamp if the packet's time is before the previous packet's timestamp. For this use case, you wanna adjust them all.

So if you have 3 packets with timestamps like:

23:00:00.100
23:01:00.345
23:05:00.678

And you ran editcap on the pcap file with -S -0.001, you'd get:

23:00:00.100
23:00:00.101
23:00:00.102

Hopefully that makes sense and helps you out.

http://www.wireshark.org/docs/man-pages/editcap.html

1
  • Thanks karyhead. Your suggestion will not only remove long pauses between 2 packets, it will change the timestamps of all packages. The effect of doing this and then tcp-replaying is the same as simply running tcpreplay-edit --pps 1000. In other words, no need to run an extra command, unless of course you want to normalize your pcap timestamps once'n'for all. Jun 17, 2014 at 11:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.