tcpdump / ethereal question

jeffk42 · 09-21-2005, 08:59 AM

I'm not very comfortable with tcpdump yet, so I thought maybe I could get some help with this.

I'm writing a service that converts a machine-specific proprietary message format to XML, allowing clients of any type to receive the data and use it. The computer that serves the messages is not easily available to me, so I'd like to be able to test as much as possible without having to constantly go through the process of setting up an appointment, driving over there, etc.

So the last time I was there I hooked up my laptop and got myself a 2 MB ethereal dump. So here's the question: I've got this file, and I'd like to be able to somehow 'replay' the network traffic on my local network, basically creating a fake server that I can test my service with.

Ideally, I'd also like to filter out any traffic not originating from the server (I figure I can do this in ethereal and export the filtered results to a new file, right?)

Also, if it is possible to do this 'replay', only the actual packet data is transferred, correct? So if the raw dump I have is coming from 10.0.40.204 and I replay it on 192.168.0.14, it will show up as coming from 192.168.0.14?

Thanks in advance,
Jeff

Gibsonist · 09-21-2005, 09:21 AM

Have you had a look at tcpreplay?
(here the official desc. taken from Debian)

Code:

Tcpreplay is aimed at testing the performance of a NIDS by replaying real
background network traffic in which to hide attacks. Tcpreplay allows you to
control the speed at which the traffic is replayed, and can replay arbitrary
tcpdump traces. Unlike programmatically-generated artificial traffic
which doesn't exercise the application/protocol inspection that a NIDS performs,
and doesn't reproduce the real-world anomalies that appear on production
networks (asymmetric routes, traffic bursts/lulls, fragmentation,
retransmissions, etc.), tcpreplay allows for exact replication
of real traffic seen on real networks.

https://sf.net/projects/tcpreplay/ http://tcpreplay.sourceforge.net/

jeffk42 · 09-22-2005, 06:30 AM

Okay, I'll give that a shot. Thanks!