Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've recently become familiar with the Layer 7 Filter project, and it's ability to classify protocols is quite interesting.

All of the information about its use, however, concerns using the filters to do queueing in real-time in order to implement bandwidth management/QOS. What I'm interested in is using the filters to classify traffic that I've already captured in pcap format.

Comments, hints, experiences, references, or wtfs, welcome.


locked by HopelessN00b Feb 16 '15 at 2:17

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

closed as off-topic by HopelessN00b Feb 16 '15 at 2:17

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

up vote 2 down vote accepted

tcpreplay wireplay preplay

There are a bunch of packages that do tcp replay of pcap files.

Sorry for the late accept, this is a great idea, though I'll have to do this from a machine off-network to prevent network from having to deal with the now-irrelevant traffic. – Cory J Jul 27 '10 at 19:31

Not the answer you're looking for? Browse other questions tagged or ask your own question.