replay snippets

How to record and replay TCP traffic

Tagged tcp, replay  Languages bash

First attempt

1) Record TCP traffic with tcpdump to pcap file

Record traffic on ethic from host and port 2332, write to app-traffic.pcap:

tcpdump -vvv -i eth0 host and port 2332 -w app-traffic.pcap &

2) View captured traffic

tcpdump -qns 0 -X -r app-traffic.pcap

Edit captured traffic if needed with Wireshark.

3) Edit source IP so that it’s on your own network

See the ”example in tcprewrite documentation”: for details on how to rewrite source IP:

$ tcprewrite --pnat=, --infile=input.pcap --outfile=output.pcap --skipbroadcast

4) Replay traffic with tcplivereplay from recorded pcap file (note step #3)

”See tcpliveplay documentation”: for details.

Note that tcpliveplay is only available on Linux not OSX.

Second attempt


sudo tcpdump -i en0 host and port 2332 -w app-traffic.pcap


tcpdump -s 0 -n -e -x -vvv -r app-traffic.pcap


sudo tcpreplay -i en0 -t -K app-traffic.pcap

Or use tcplivereplay (Note: Linux only):\#tcpliveplay


I couldn’t get it to work….