0

I capture traffic on my local interface with tcpdump (in pcap/pcapng file) and I want to study it using apps like Charles/Fiddler, but then I have to direct it to its proxy somehow.

How can I replay the captured traffic to a specific address and port? (preferably on macOS)

user1261347
  • 101

1 Answers1

0

Just based on the way you phrase your question and the tagging you chose it's really not clear to me what exactly you want to do. It doesn't seem to be entirely clear to yourself either. Here's why:

  • you talk about analyzing traffic captured with tcpdump, which is a traffic analysis tool
  • you ask for a tool to replay captured traffic, and tag the question with "tcpreplay" which is a tool to replay captured traffic
  • you talk about directing traffic to "its proxy", and want to use Charles to analyze it - but Charles is a proxy you use to capture and analyze traffic
  • talking about replaying traffic to a specific address and port is also unclear - if the dump contains packets destined to 10.0.0.10, you can't just send them to 192.168.0.100. Once they reach the wire they will become live network traffic trying to find its way to 10.0.0.10, it will hit 192.168.0.100 only if it happens to be on the path.

So the question is what exactly you want to do. For every task you can find a tool, once you specify the task. I mean it is possible to stick screws on a wall with a hammer, but it's not necessarily the easiest or most efficient way.

As a traffic analysis tool, nothing beats Wireshark. There are other analyzers, but Wireshark has become an industry standard, you will it find in every network admins toolbox. That's probably due to the exorbitant price of totally free. It's Open Source.

You can use it to capture live traffic and analyze it on the spot and/or save it as .pcapng (or older .pcap, if you please) file; or you can of course open a saved capture file for analysis. You can filter the traffic every which way; for example "I want to see only HTTPS packets sent from my computer to acme.com" is a trivial task. Or you can follow an entire TCP stream between your system and acme.com.

Wireshark is actually just a GUI. What's running underneath is the good ole tcpdump and libpcap, among a (large!) pile of other standard OS tools. So you can simply open the capture with tcpdump itself for analysis and filter it like you want, but you're looking at raw output interpreted in ASCII, which is a tad challenging to read. Wireshark makes it a lot more convenient.

Going to Apple Store you can install Cocoa Packet Analyzer. It's also a free tool. I've never looked at it previously, but downloaded and installed it just now, and probably won't launch it a second time. The interface looks similar to Wireshark's. It can't be used to capture, only for analysis; and it can only open old-style .pcap files, not .pcapng (pcap next generation). Those two facts alone make it useless to me, but have a look - it might suit you well.

I'm not familiar with either Charles or Fiddler, so I can't talk about details, I only know what I read from the webpages. Based on that they're in a different category.

Both are paid tools. The target audience seems to be web developers. They are marketed as "web debugging tools". I'm guessing they also use tcpdump at the core (why reinvent the wheel?), but looks like the output is filtered already coming in, they only seem to show HTTP/HTTPS traffic. They seem to contain utilities that would be helpful for the target audience, for example some timings can be shown as graphs.

Then there are the packet players. I (you) already mentioned tcpreplay. For Windows there's Colasoft Packet Player. And that's about it... there's not enough need for this kind of task to create any really noticeable market to bring out competing solutions.

There are also tools used to craft packets manually. For troubleshooting purposes it can be very useful to send malformed traffic to a device of application, but you need to understand network packets in the first place to be able to do this. I'm mentioning them just for completeness.

So, again, what to use boils down to is what exactly you need. If you're a private person who wants to learn and understand network traffic by analyzing saved captures; or occasionally check what exactly is going on between your system and acme.com, Wireshark's your friend. If you're a web developer wanting to analyze the behavior of your web application and don't mind paying for the convenience, you probably will benefit from the tools available with Charles or Fiddler. But knowing Wireshark can still be beneficial - limited tools have limits.

If you specifically want to learn to use Charles or Fiddler, you obviously install and run those tools. You'll learn the basic how-to reading the manuals, or perhaps you'll find instructional vids in Youtube, Vimeo or similar. At least for Wireshark you will find a metric ton of content.

Peregrino69
  • 5,004