Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is there a freeware Windows/Linux GUI packet replay tool that has the advanced features of tcpreplay (http://tcpreplay.synfin.net/) or bittwist (http://bittwist.sourceforge.net)? I'm particularly interested in the following features:

  1. Open pcap files for editing and injecting into arbitrary network
  2. Change source and destination addresses/ports of UDP packets
  3. Change packet timing (with millisecond resolution)
  4. Edit packet contents, including modifying its length
  5. Has graphical front end for Windows or Linux (or Mac OS X)

I've scanned a couple lists of potential tools (here and here), but nothing really fits my requirements. The closest tool might be Ostinato (http://code.google.com/p/ostinato/), but it doesn't appear to open packet capture files. Thanks for any help!

share|improve this question

closed as off topic by Dan, sysadmin1138 Dec 6 '12 at 3:27

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Have you tried Ostinato? The "Features" section on its page says "Open, edit, replay and save PCAP files". –  Gerald Combs Jun 9 '11 at 18:40
    
Product recommendations, including if-exists recon, are off-topic per the FAQ(http//serverfault.com/faq). –  sysadmin1138 Dec 6 '12 at 3:27
add comment

2 Answers

I always use Wireshark (formerly ethereal) for simple decode and analysis. While the price is right (free) and the cross-platform GUI functional, the feature set does not meet your complete list. There is also professional tool ($) from Fluke Networks called ClearSight™ Analyzer. It will replay multimedia streams, etc from pcap files.

share|improve this answer
add comment

Ettercap might work for you. I have only played around with its basic features, but it will allow you to do packet injection into a packet stream and has a wide range of plug-ins available, some of which might be useful to you.

I don't know of anyway offhand to modify packets "on-the-fly" without already being a part of the tcp stream.

EDIT: Oh I forgot about ettercap filters... filter video tutorial

share|improve this answer
    
Thanks. Ettercap looks useful, but it doesn't open pcap files or support changing the packet timing (although, I might be able to use the exec command to sleep between packets). –  superuser Feb 20 '11 at 22:14
    
Before you dismiss it, I suggest you read through the manual. Like I said, I'm not that familiar with Ettercap but I think it can do most of what you want. Although, you'll probably have to combine some tools to get all the functionality you're looking for. Sorry, I can't be more helpful. –  kce Feb 21 '11 at 2:33
    
Ok, you're right: it can open pcap files. I don't see timing control. I might just have to roll my own GUI for tcpreplay. –  superuser Feb 23 '11 at 5:13
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.