There is some .pcap-file with fragmented IP traffic. I replay this file with tcpreplay, but also I need to replay it with DF (don't fragment) bit set in some packets.

I supposed that tcprewrite will help, but it seems that there is no ability to change IP-header flags in this utility.

So which utility (console preferably) should I use to correctly alter IP-header flags in pcap-file in Linux? If tcprewrite or any other can do so, some examples would be helpful.

By the way, after altering DF-bit the checksum of IP-header should be updated respectively.

1 Answer 1


There are various methods I would approach this.

If there aren't many packets, or it's a onetime change, I really like WireEdit, TraceWrangler is another GUI option.

Otherwise, two options if you have any programming experience, are Scapy(python), and PcapPlusPlus(C++). This PcapPlusPlus link might be enough of a tutorial of what you are trying to do, that with very little programming experience you can do what you want.

Finally, I found bittwist that is an older application, but has the -f d option.

       -f flags
                 Control flags. Possible characters for flags are:

                 - : remove all flags
                 r : set the reserved flag
                 d : set the don’t fragment flag
                 m : set the more fragment flag

                 Example: -f d
                 If  any of the flags is specified, all original flags are
                 removed automatically.
  • Unfortunately, bittwist (ver. 2.0) installed either from jessie main or from wheezy-backports (as mentioned here) has no -f option at all despite its man on site.
    – red0ct
    Oct 18, 2018 at 9:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .