How to tcpreplay only packets satisfying a pcap filter rule?

Question

I have a dump file with lots of various packets in it, but I want to selectively replay, say, only all udp packets to a given port number, without having to edit the dump file first.

How?

score 5 · Accepted Answer · answered Jul 08 '16 at 06:06

5

tcpdump can do the filtering and its result then be piped to tcpreplay.

tcpdump -r dump.pcap -w- 'udp port 1234' | tcpreplay -ieth0 -

answered Jul 08 '16 at 06:06

Evgeniy Berezovsky

870

How to tcpreplay only packets satisfying a pcap filter rule?

1 Answers1