Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've recently become familiar with the Layer 7 Filter project, and it's ability to classify protocols is quite interesting.

All of the information about its use, however, concerns using the filters to do queueing in real-time in order to implement bandwidth management/QOS. What I'm interested in is using the filters to classify traffic that I've already captured in pcap format.

Comments, hints, experiences, references, or wtfs, welcome.

share|improve this question

1 Answer 1

up vote 2 down vote accepted

tcpreplay wireplay preplay

There are a bunch of packages that do tcp replay of pcap files.

share|improve this answer
Sorry for the late accept, this is a great idea, though I'll have to do this from a machine off-network to prevent network from having to deal with the now-irrelevant traffic. –  Cory J Jul 27 '10 at 19:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.