I can do it using an intermediate pcap file:

tcpdump -i lo -s 0 -w out.pcap 'tcp and port 12345'
tcpreplay -i eth1 out.pcap

Is it possible to skip the pcap and forward all the traffic immediately? This would be extremely useful for long-running captures, where the pcaps can grow to gigabytes in size.

1 Answer 1


The solution is to write the tcpdump output to stdout and have tcpreplay read from stdin:

 tcpdump -i lo -w - 'tcp and port 12345' | tcpreplay -i eth1 -

It seems that tcpreplay doesn't exit on a broken pipe, so, after closing tcpdump with Ctrl-C, you'll have to kill tcpreplay separately.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.