I can do it using an intermediate pcap file:

tcpdump -i lo -s 0 -w out.pcap 'tcp and port 12345'
tcpreplay -i eth1 out.pcap

Is it possible to skip the pcap and forward all the traffic immediately? This would be extremely useful for long-running captures, where the pcaps can grow to gigabytes in size.

1 Answer 1


The solution is to write the tcpdump output to stdout and have tcpreplay read from stdin:

 tcpdump -i lo -w - 'tcp and port 12345' | tcpreplay -i eth1 -

It seems that tcpreplay doesn't exit on a broken pipe, so, after closing tcpdump with Ctrl-C, you'll have to kill tcpreplay separately.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .