How to send tcpdump-captured traffic directly to an interface?

Question

I can do it using an intermediate pcap file:

tcpdump -i lo -s 0 -w out.pcap 'tcp and port 12345'
^C
tcpreplay -i eth1 out.pcap

Is it possible to skip the pcap and forward all the traffic immediately? This would be extremely useful for long-running captures, where the pcaps can grow to gigabytes in size.

Answer 1

The solution is to write the tcpdump output to stdout and have tcpreplay read from stdin:

 tcpdump -i lo -w - 'tcp and port 12345' | tcpreplay -i eth1 -

It seems that tcpreplay doesn't exit on a broken pipe, so, after closing tcpdump with Ctrl-C, you'll have to kill tcpreplay separately.