tcpreplay v4.3.0 releases: Pcap editing and replay tools for *NIX and Windows

Tcpreplay is a suite of GPLv3 licensed utilities for UNIX (and Win32 under Cygwin) operating systems for editing and replaying network traffic which was previously captured by tools like tcpdump and Ethereal/Wireshark. It allows you to classify traffic as client or server, rewrite Layer 2, 3 and 4 packets and finally replay the traffic back onto the network and through other devices such as switches, routers, firewalls, NIDS and IPS’s. Tcpreplay supports both single and dual NIC modes for testing both sniffing and in-line devices.

Tcpreplay is used by numerous firewall, IDS, IPS, NetFlow and other networking vendors, enterprises, universities, labs and open source projects. If your organization uses Tcpreplay, please let us know who you are and what you use it for so that I can continue to add features which are useful.

Tcpreplay is designed to work with network hardware and normally does not penetrate deeper than Layer 2. Yazan Siam with sponsorship from Cisco developed tcpliveplay to replay TCP pcap files directly to servers. Use this utility if you want to test the entire network stack and into the application.

Features

• Edit PCAP files
• Replays PCAP files to devices under test (DUT)
• Designed for IDS/IPS
• NetFlow testing
• Up to 10GigE wire rate playback
• Flow performance testing

The Tcpreplay suite includes the following tools:

Network playback products:

• tcpreplay – replays pcap files at arbitrary speeds onto the network with an option to replay with random IP addresses
• tcpreplay-edit – replays pcap files at arbitrary speeds onto the network with numerous options to modify packets on the fly
• tcpliveplay – replays TCP network traffic stored in a pcap file on live networks in a manner that a remote server will respond to

Pcap file editors and utilities:

• tcpprep – multi-pass pcap file pre-processor which determines packets as client or server and splits them into creates output files for use by tcpreplay and tcprewrite
• tcprewrite – pcap file editor which rewrites TCP/IP and Layer 2 packet headers
• tcpbridge – bridge two network segments with the power of tcprewrite
• tcpcapinfo – raw pcap file decoder and debugger

Changelog v4.3.0

This release contains several bug fixes and enhancements:

• Fix maxOS TOS checksum failure (#524)
• TCP sequence edits seeding (#514)
• Fix issues identifed by Codacy (#493)
• CVE-2018-18408 use-after-free in post_args (#489)
• CVE-2018-18407 heap-buffer-overflow csum_replace4 (#488)
• CVE-2018-17974 heap-buffer-overflow dlt_en10mb_encode (#486)
• CVE-2018-17580 heap-buffer-overflow fast_edit_packet (#485)
• CVE-2018-17582 heap-buffer-overflow in get_next_packet (#484)
• Out-of-tree build (#482)
• CVE-2018-13112 heap-buffer-overflow in get_l2len (#477 dup #408)
• Closing stdin on pipe (#479)
• Second pcap file hangs on multiplier option (#472)
• Jumbo frame support for fragroute option (#466)
• TCP sequence edit ACK corruption (#451)
• TCP sequence number edit initial SYN packet should have zero ACK (#450)
• Travis CI build fails due to new build images (#432)
• Upgrade libopts to 5.18.12 to address version build issues (#430)
• Add ability to change tcp SEQ/ACK numbers (#425)
• Hang using loop and netmap options (#424)
• tcpprep -S not working for large cache files (#423)
• Unable to tcprewrite range of ports with –portmap (#422)
• –maxsleep broken for values less than 1000 (#421)
• -T flag breaks traffic replay timing (#419)
• Respect 2nd packet timing (#418)
• Avoid non-blocking behaviour when using STDIN (#416)
• pcap containing >1020 packets produces invalid cache file (#415)
• manpage typos (#413)
• Fails to open tap0 on Zephyr (#411)
• Heap-buffer-overflow in get_l2protocol (#410)
• Heap-buffer-overflow in packet2tree (#409)
• Heap-buffer-overflow in get_l2len (#408)
• Heap-buffer-overflow in flow_decode (#407)
• Rewrite zero IP total length field to match the actual packet length (#406)
• Stack-buffer-overflow in tcpcapinfo (#405)
• tcpprep –include option does not exclude (#404)
• Negative-size-param memset in dlt_radiotap_get_80211 (#402)
• tcpeplay –verbose option not working (#398)
• Fix replay when using –with-testnic (#178)

Download

Demo

Tutorial

Source: https://github.com/appneta/