There is some .pcap-file with fragmented ip traffic. I replay this file with tcpreplay, but also I need to replay it with DF (don't fragment) bit set in some packets.

I supposed that tcprewrite will help, but it seems that there is no ability to change ip-header flags in this utility.

So which utility (console preferably) should I use to correctly alter ip-header flags in pcap-file in Linux? If tcprewrite or any other can do so, some examples would be helpful.

By the way, after altering DF-bit the checksum of ip-header should be updated respectively.


There are various methods I would approach this.

If there aren't many packets, or it's a onetime change, I really like WireEdit, TraceWrangler is another GUI option.

Otherwise, two options if you have any programming experience, are Scapy(python), and PcapPlusPlus(C++). This PcapPlusPlus link might be enough of a tutorial of what you are trying to do, that with very little programming experience you can do what you want.

Finally, I found bittwist that is an older application, but has the -f d option.

       -f flags
                 Control flags. Possible characters for flags are:

                 - : remove all flags
                 r : set the reserved flag
                 d : set the don’t fragment flag
                 m : set the more fragment flag

                 Example: -f d
                 If  any of the flags is specified, all original flags are
                 removed automatically.
  • Unfortunately, bittwist (ver. 2.0) installed either from jessie main or from wheezy-backports (as mentioned here) has no -f option at all despite its man on site. – red0ct Oct 18 '18 at 9:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.