Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

There is a bug in my web application which I cannot reproduce. All the logs look ok or at least I cannot see anything unusual. But it happens. So I thought I could record all the traffic to/from my web site waiting for the bug to happen and having that, replay it somehow in my testing environment. And it did happen! So I have the data captured by this:

tcpdump -s 1514 -X tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0) -Z root -C 20 -W 1000 -w capture.cap

and I don't know what can I do with it. I have a virtual machine running the same version of the web app and I'd like to replay the recorded data in it. How should I approach this?


I tried doing this with tcpreplay following this example but my web server has not logged any traffic.

My testing machine (Fedora 8) runs in VMWare Player. Assuming that the IP of the machine is and it has one network interface: eth0 (except loopback) - how the steps #2 and #3 from the example should look like in my case? Should I run it on the same machine or from another one?

share|improve this question

You have a few options, all of them cool and none of them drop-in products. Some assembly required.

What you will likely want to do is forget the logs you've already inspected, or at least abandon any desire to replay those files. Set up one of these systems and use it in a controlled manner to test out your traffic.

share|improve this answer
Thanks, for the reply however I'd like to use the dump I already have as the customer is pissed off and I cannot wait for the next occurrence of the bug. Do you have any experience with tcpreplay? I tried to use it according to the docs but without success. Can I run it on the machine being tested or from another one? It would be great if you could drop any snipped of code I could start with. – tomazy Aug 12 '11 at 6:38
I haven't used TCPReplay. I think it has to be used from a "transparent inline device" and not the machine being tested on though. – Wesley Aug 12 '11 at 7:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.