Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to test network device code by replaying captured traffic. The middle-box(bridge) has two interfaces, connected to hosts machine-A and machine-B. The captured traffic in the pcap file contains traffic between three different IP addresses. I want to replay traffic originating from 2 of these IP addresses from machine-A(as clients) and replay the traffic originating from the remaining IP address from machine-B(as a server). I want to replay the traffic at top-speed but preserve the relative order of the packets seen by the bridge. That is, if the order of packets in the original capture file is (Time, Soruce, Destination):

1s client1 --> server1

5s client1 --> server1

8s server1 --> client1

I want machine-A to act in the client mode and send first two packets asap. I want machine-B to act in the server mode and it should send third packet as soon as it receives the first two packets and so-on. I will decide which IP addresses are to be treated as clients and which ones are servers.

I looked at tcpreplay and tcpprep tools. But I don't think they support replaying from different machines while preserving a chronological order. Before hacking something like this using scapy, I want to know if there is an easier way to do it?

share|improve this question

It would help very much if you describe the problem that you are trying to solve; maybe there is a whole other way to do it. Keeping transmissions from various hosts in sync and at "top speed" is not an easy task.

Update: That you are configuring some logic tells me, that this is a situation/combination which occurs more than once - is it maybe easier to cajole the clients and the server to reenact the scenario you want to see?

Otherwise, to keep several network connections synchronized, I'd take one computer with several network cards and try to concoct a script there.

It's not trivial in any case, if there is more than a small number of packets. Try so simplify...

share|improve this answer
I want to test a network device. I want to do so by running client and server side of the captured file from different hosts. The replayed packets will flow through the DUT in opposite directions. Each machine should have the same capture file and run in either the client or a server mode. Each machine will expect packets on an interface. Once it gets those expected packets, it will send the next batch of packets from the capture file and wait till it gets the next batch of expected packets. – Methos Aug 22 '10 at 9:10
What is it that you want to test regarding network device? Firewall/routing/bridging rules? Performance? – slovon Aug 22 '10 at 10:29
I have modified some processing logic and I want to test the functionality. – Methos Aug 23 '10 at 8:16
Its a modified bridge that can also do deep packet inspection and keep some state per flow. – Methos Aug 23 '10 at 8:17

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.