Source From Here
Preface
When you are testing or debugging middlebox hardware such as routers, switches, or IDS/IPS, it is extremely useful to perform the testing with reproducible network traffic. Using repeatable traffic minimizes any kind of uncertainty in the testing environment, thereby making testing results easier to interprete and analyze. In Linux, there is a suites of command-line utilities called tcpreplay which can replay captured network traffic.
In this tutorial, I will show you how to capture live network traffic, and replay the captured network traffic elsewhere by using tcpreplay, tcpdump andtcprewrite.
Capture Live Network Traffic
First, install tcpreplay and tcpdump on Linux. To install tcpreplay, follow the instruction here.
The next step is to capture live network traffic, and dump it to a pcap file. To do so, run tcpdump command as follows. I assume that eth0 is the sniffing interface which is set to promiscuous mode:
Rewrite Packets in Traffic Dump
Next, rewrite packets captured in a pcap file, so that we can replay them between a pair of any two arbitrary hosts (different from the original traffic source and sink). Run a series of the following commands to perform such packet rewriting.
1. Rewrite any destination IP address and MAC address in traffic dump to 192.168.1.20 and E0:DB:55:CC:13:F1, respectively:
2. Rewrite any source IP address and MAC address in traffic dump to 192.168.1.10 and 84:A5:C8:BB:58:1A, respectively:
3. Update the checksum of every packet:
After you are done with packet rewriting, you can go ahead and replay the finalized packet dump as follows.
Customize Traffic Replay Settings
The tcpreplay command offers various options to customize replay settings (e.g., speed, duration, performance).
1. To loop through a pcap file 100 times:
2. To cache a pcap file in RAM after the first time, so that subsequent loops do not incur disk I/O latency:
3. To replay traffic five times as fast as the original traffic was captured
4. To replay traffic at a rate of 10Mbps:
5. To replay traffic at 100 packets per second:
6. To replay traffic in infinite loops or until CTRL-C is pressed:
7. Replay traffic as quickly as possible:
Summary
In this tutorial, I demonstrated how to modify packet traces in a systematic way using tcprewrite, and inject them on to the network with tcpreplay. Combined withother pcap manipulation tools, they will give you an effective means to do various network testing and troubleshooting in a more controlled environment.
Supplement
* Tcpdump Commands – A Network Sniffer Tool
Preface
When you are testing or debugging middlebox hardware such as routers, switches, or IDS/IPS, it is extremely useful to perform the testing with reproducible network traffic. Using repeatable traffic minimizes any kind of uncertainty in the testing environment, thereby making testing results easier to interprete and analyze. In Linux, there is a suites of command-line utilities called tcpreplay which can replay captured network traffic.
In this tutorial, I will show you how to capture live network traffic, and replay the captured network traffic elsewhere by using tcpreplay, tcpdump andtcprewrite.
Capture Live Network Traffic
First, install tcpreplay and tcpdump on Linux. To install tcpreplay, follow the instruction here.
The next step is to capture live network traffic, and dump it to a pcap file. To do so, run tcpdump command as follows. I assume that eth0 is the sniffing interface which is set to promiscuous mode:
Rewrite Packets in Traffic Dump
Next, rewrite packets captured in a pcap file, so that we can replay them between a pair of any two arbitrary hosts (different from the original traffic source and sink). Run a series of the following commands to perform such packet rewriting.
1. Rewrite any destination IP address and MAC address in traffic dump to 192.168.1.20 and E0:DB:55:CC:13:F1, respectively:
2. Rewrite any source IP address and MAC address in traffic dump to 192.168.1.10 and 84:A5:C8:BB:58:1A, respectively:
3. Update the checksum of every packet:
After you are done with packet rewriting, you can go ahead and replay the finalized packet dump as follows.
Customize Traffic Replay Settings
The tcpreplay command offers various options to customize replay settings (e.g., speed, duration, performance).
1. To loop through a pcap file 100 times:
2. To cache a pcap file in RAM after the first time, so that subsequent loops do not incur disk I/O latency:
3. To replay traffic five times as fast as the original traffic was captured
4. To replay traffic at a rate of 10Mbps:
5. To replay traffic at 100 packets per second:
6. To replay traffic in infinite loops or until CTRL-C is pressed:
7. Replay traffic as quickly as possible:
Summary
In this tutorial, I demonstrated how to modify packet traces in a systematic way using tcprewrite, and inject them on to the network with tcpreplay. Combined withother pcap manipulation tools, they will give you an effective means to do various network testing and troubleshooting in a more controlled environment.
Supplement
* Tcpdump Commands – A Network Sniffer Tool
沒有留言:
張貼留言