123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370 |
- .TH TCPREPLAY 1 2010-04-04 "(tcpreplay )" "Programmer's Manual"
- .\" DO NOT EDIT THIS FILE (tcpreplay.1)
- .\"
- .\" It has been AutoGen-ed April 4, 2010 at 05:59:19 PM by AutoGen 5.9.9
- .\" From the definitions tcpreplay_opts.def
- .\" and the template file agman1.tpl
- .\"
- .SH NAME
- tcpreplay \- Replay network traffic stored in pcap files
- .SH SYNOPSIS
- .B tcpreplay
- .\" Mixture of short (flag) options and long options
- .RB [ \-\fIflag\fP " [\fIvalue\fP]]... [" \--\fIopt-name\fP " [[=| ]\fIvalue\fP]]..."
- .br
- .in +8
- <pcap_file(s)>
- .PP
- tcpreplay is a tool for replaying network traffic from files saved with
- tcpdump or other tools which write pcap(3) files.
- .SH "DESCRIPTION"
- This manual page briefly documents the \fBtcpreplay\fP command.
- The basic operation of tcpreplay is to resend all packets from the
- input file(s) at the speed at which they were recorded, or a specified
- data rate, up to as fast as the hardware is capable.
- Optionally, the traffic can be split between two interfaces, written to
- files, filtered and edited in various ways, providing the means to test
- firewalls, NIDS and other network devices.
- For more details, please see the Tcpreplay Manual at:
- http://tcpreplay.synfin.net/trac/wiki/manual
- .SH OPTIONS
- .TP
- .BR \-d " \fInumber\fP, " \--dbug "=" \fInumber\fP
- Enable debugging output.
- This option may appear up to 1 times.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- in the range 0 through 5
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 0
- .sp
- If configured with \--enable-debug, then you can specify a verbosity
- level for debugging output. Higher numbers increase verbosity.
- .TP
- .BR \-q ", " \--quiet
- Quiet mode.
- .sp
- Print nothing except the statistics at the end of the run
- .TP
- .BR \-T " \fIstring\fP, " \--timer "=" \fIstring\fP
- Select packet timing mode: select, ioport, rdtsc, gtod, nano, abstime.
- This option may appear up to 1 times.
- The default \fIstring\fP for this option is:
- .ti +4
- gtod
- .sp
- Allows you to select the packet timing method to use:
- .sp
- .IR "nano"
- - Use nanosleep() API
- .sp
- .IR "select"
- - Use select() API
- .sp
- .IR "ioport"
- - Write to the i386 IO Port 0x80
- .sp
- .IR "rdtsc"
- - Use the x86/x86_64/PPC RDTSC
- .sp
- .IR "gtod [default]"
- - Use a gettimeofday() loop
- .sp
- .IR "abstime"
- - Use OS X's AbsoluteTime API
- .br
- .TP
- .BR \--sleep-accel "=\fInumber\fP"
- Reduce the amount of time to sleep by specified usec.
- This option takes an integer number as its argument.
- The default \fInumber\fP for this option is:
- .ti +4
- 0
- .sp
- Reduce the amount of time we would normally sleep between two packets by the
- specified number of usec. This provides a "fuzz factor" to compensate for
- running on a non-RTOS and other processes using CPU time. Default is disabled.
- .TP
- .BR \--rdtsc-clicks "=\fInumber\fP"
- Specify the RDTSC clicks/usec.
- This option may appear up to 1 times.
- This option takes an integer number as its argument.
- The default \fInumber\fP for this option is:
- .ti +4
- 0
- .sp
- Override the calculated number of RDTSC clicks/usec which is often the speed of the
- CPU in Mhz. Only useful if you specified \fB--timer=rdtsc\fP
- .TP
- .BR \-v ", " \--verbose
- Print decoded packets via tcpdump to STDOUT.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-A " \fIstring\fP, " \--decode "=" \fIstring\fP
- Arguments passed to tcpdump decoder.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- verbose.
- .sp
- When enabling verbose mode (\fB-v\fP) you may also specify one or more
- additional arguments to pass to \fBtcpdump\fP to modify the way packets
- are decoded. By default, \-n and \-l are used. Be sure to
- quote the arguments like: \-A "-axxx" so that they are not interpreted
- by tcpreplay. Please see the tcpdump(1) man page for a complete list of
- options.
- .TP
- .BR \-K ", " \--enable-file-cache
- Enable caching of packets to internal memory.
- This option must appear in combination with the following options:
- loop.
- .sp
- Cache pcap file(s) the first time they are cached in RAM so that subsequent
- loops don't incurr any disk I/O latency in order to increase performance. Make
- sure you have enough free RAM to store the entire pcap file(s) in memory or the
- system will swap and performance will suffer.
- .TP
- .BR \--preload-pcap
- Preloads packets into RAM before sending.
- .sp
- This option loads the specified pcap(s) into RAM before starting to send in order
- to improve replay performance while introducing a startup performance hit.
- Preloading can be used with or without \fB--loop\fP and implies
- \fB--enable-file-cache\fP.
- .TP
- .BR \-c " \fIstring\fP, " \--cachefile "=" \fIstring\fP
- Split traffic via a tcpprep cache file.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-i " \fIstring\fP, " \--intf1 "=" \fIstring\fP
- Server/primary traffic output interface.
- This option may appear up to 1 times.
- .sp
- .TP
- .BR \-I " \fIstring\fP, " \--intf2 "=" \fIstring\fP
- Client/secondary traffic output interface.
- This option may appear up to 1 times.
- This option must appear in combination with the following options:
- cachefile.
- .sp
- .TP
- .BR \--listnics
- List available network interfaces and exit.
- .sp
- .TP
- .BR \-l " \fInumber\fP, " \--loop "=" \fInumber\fP
- Loop through the capture file X times.
- This option may appear up to 1 times.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- greater than or equal to 0
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 1
- .sp
- .TP
- .BR \--pktlen
- Override the snaplen and use the actual packet len.
- This option may appear up to 1 times.
- .sp
- By default, tcpreplay will send packets based on the size of the "snaplen"
- stored in the pcap file which is usually the correct thing to do. However,
- occasionally, tools will store more bytes then told to. By specifying this
- option, tcpreplay will ignore the snaplen field and instead try to send
- packets based on the original packet length. Bad things may happen if
- you specify this option.
- .TP
- .BR \-L " \fInumber\fP, " \--limit "=" \fInumber\fP
- Limit the number of packets to send.
- This option may appear up to 1 times.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- greater than or equal to 1
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- \-1
- .sp
- By default, tcpreplay will send all the packets. Alternatively, you can
- specify a maximum number of packets to send.
- .TP
- .BR \-x " \fIstring\fP, " \--multiplier "=" \fIstring\fP
- Modify replay speed to a given multiple.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- pps, mbps, oneatatime, topspeed.
- .sp
- Specify a floating point value to modify the packet replay speed.
- Examples:
- .nf
- 2.0 will replay traffic at twice the speed captured
- 0.7 will replay traffic at 70% the speed captured
- .fi
- .TP
- .BR \-p " \fInumber\fP, " \--pps "=" \fInumber\fP
- Replay packets at a given packets/sec.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- multiplier, mbps, oneatatime, topspeed.
- This option takes an integer number as its argument.
- .sp
- .TP
- .BR \-M " \fIstring\fP, " \--mbps "=" \fIstring\fP
- Replay packets at a given Mbps.
- This option may appear up to 1 times.
- This option must not appear in combination with any of the following options:
- multiplier, pps, oneatatime, topspeed.
- .sp
- Specify a floating point value for the Mbps rate that tcpreplay
- should send packets at.
- .TP
- .BR \-t ", " \--topspeed
- Replay packets as fast as possible.
- This option must not appear in combination with any of the following options:
- mbps, multiplier, pps, oneatatime.
- .sp
- .TP
- .BR \-o ", " \--oneatatime
- Replay one packet at a time for each user input.
- This option must not appear in combination with any of the following options:
- mbps, pps, multiplier, topspeed.
- .sp
- Allows you to step through one or more packets at a time.
- .TP
- .BR \--pps-multi "=\fInumber\fP"
- Number of packets to send for each time interval.
- This option must appear in combination with the following options:
- pps.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- greater than or equal to 1
- .fi
- .in -4
- The default \fInumber\fP for this option is:
- .ti +4
- 1
- .sp
- When trying to send packets at very high rates, the time between each packet
- can be so short that it is impossible to accurately sleep for the required
- period of time. This option allows you to send multiple packets at a time,
- thus allowing for longer sleep times which can be more accurately implemented.
- .TP
- .BR \-P ", " \--pid
- Print the PID of tcpreplay at startup.
- .sp
- .TP
- .BR \--stats "=\fInumber\fP"
- Print statistics every X seconds.
- This option takes an integer number as its argument.
- The value of \fInumber\fP is constrained to being:
- .in +4
- .nf
- .na
- greater than or equal to 1
- .fi
- .in -4
- .sp
- Note that this is very much a "best effort" and long delays between
- sending packets may cause equally long delays between printing statistics.
- .TP
- .BR \-V ", " \--version
- Print version information.
- .sp
- .TP
- .BR \-h ", " \--less-help
- Display less usage information and exit.
- .sp
- .TP
- .BR \-H , " \--help"
- Display usage information and exit.
- .TP
- .BR \-! , " \--more-help"
- Extended usage information passed thru pager.
- .TP
- .BR \- " [\fIrcfile\fP]," " \--save-opts" "[=\fIrcfile\fP]"
- Save the option state to \fIrcfile\fP. The default is the \fIlast\fP
- configuration file listed in the \fBOPTION PRESETS\fP section, below.
- .TP
- .BR \- " \fIrcfile\fP," " \--load-opts" "=\fIrcfile\fP," " \--no-load-opts"
- Load options from \fIrcfile\fP.
- The \fIno-load-opts\fP form will disable the loading
- of earlier RC/INI files. \fI--no-load-opts\fP is handled early,
- out of order.
- .SH OPTION PRESETS
- Any option that is not marked as \fInot presettable\fP may be preset
- by loading values from configuration ("RC" or ".INI") file(s).
- The \fIhomerc\fP file is "\fI$$/\fP", unless that is a directory.
- In that case, the file "\fI.tcpreplayrc\fP"
- is searched for within that directory.
- .SH "SIGNALS"
- tcpreplay understands the following signals:
- .sp
- .IR "\fBSIGUSR1\fP"
- Suspend tcpreplay
- .sp
- .IR "\fBSIGCONT\fP"
- Restart tcpreplay
- .br
- .SH "SEE ALSO"
- tcpreplay-edit(1), tcpdump(1), tcpprep(1), tcprewrite(1), libnet(3)
- .SH "BUGS"
- tcpreplay can only send packets as fast as your computer's interface,
- processor, disk and system bus will allow.
- Packet timing at high speeds is a black art and very OS/CPU dependent.
- Replaying captured traffic may simulate odd or broken conditions on your
- network and cause all sorts of problems.
- In most cases, you can not replay traffic back to/at a server.
- Some operating systems by default do not allow for forging source MAC
- addresses. Please consult your operating system's documentation and the
- tcpreplay FAQ if you experience this issue.
- .SH AUTHOR
- Copyright 2000-2010 Aaron Turner
- For support please use the tcpreplay-users@lists.sourceforge.net mailing list.
- The latest version of this software is always available from:
- http://tcpreplay.synfin.net/
- .PP
- Released under the Free BSD License.
- .PP
- This manual page was \fIAutoGen\fP-erated from the \fBtcpreplay\fP
- option definitions.
|