tcpreplay

Tcpreplay is designed for testing the performance of Network Intrusion Detection Systems (NIDS) by replaying real background network traffic to hide attacks. Unlike artificial traffic generators, tcpreplay uses actual tcpdump traces which exercise application/protocol inspection and reproduce real-world network anomalies such as asymmetric routes, traffic bursts, fragmentation, and retransmissions.

The suite includes multiple executables: tcpreplay for replaying traffic, tcpprep for creating cache files with processing rules, tcprewrite for rewriting packets in pcap files, tcpreplay-edit for endpoint modifications, tcpbridge for bridging traffic across interfaces, tcpcapinfo for pcap file dissection, and tcpliveplay for replaying with new TCP connections. This enables exact replication of production network traffic for testing firewalls, NIDS, and other network devices.

Traffic can be split between two interfaces, written to files, filtered, and edited according to specific needs. The tools support various DLT types and provide extensive packet modification capabilities including IP/port rewriting, checksum recalculation, fuzzing, and VLAN tagging.

Tcpreplay reads pcap files containing captured network traffic and replays packets out specified network interfaces at controlled speeds (pps, mbps, topspeed, or one-at-a-time). It uses tcpprep cache files to determine client/server traffic direction for dual-interface replay. Packets can be pre-processed with tcprewrite to modify headers (IP addresses, ports, MAC, TTL, TOS), recalculate checksums, apply fuzzing, or simulate fragmentation. Tcpbridge enables selective bridging with packet editing between two interfaces. Tcpliveplay rewrites captured TCP sessions to use new connections against live targets while maintaining protocol SEQ/ACK expectations.