Replay UDP Packet Capture
Rise to the top 3% as a developer or hire one of them at Toptal: https://topt.al/25cXVn
--------------------------------------------------
Music by Eric Matyas
https://www.soundimage.org
Track title: Dream Voyager Looping
--
Chapters
00:00 Replay Udp Packet Capture
00:36 Answer 1 Score 10
02:44 Accepted Answer Score 3
03:36 Thank you
--
Full question
https://superuser.com/questions/382264/r...
--
Content licensed under CC BY-SA
https://meta.stackexchange.com/help/lice...
--
Tags
#playback #sniffing
#avk47
ANSWER 1
Score 10
BitTwist (http://bittwist.sourceforge.net) should be able to do what you want.
With Bit-Twist, you can now regenerate your captured traffic onto a live network! Packets are generated from tcpdump trace file (.pcap file). Bit-Twist also comes with a comprehensive trace file editor to allow you to change the contents of a trace file.
The "trace file editor" part is what you are most interested in here.
I think you need to transform in two passes: one to change the IP addresses, another to change the UDP port numbers. I believe you can do this in either order.
bittwiste -I original.pcap -O changedip.pcap -T ip -s IP1,IP3 -d IP2,IP4
bittwiste -I changedip.pcap -O changedipandport.pcap -T udp -s Port1,Port3 -d Port2,Port4
where you need to stick in the IP addresses and port numbers, eg
bittwiste -I original.pcap -O changedip.pcap -T ip -s 192.168.0.1,10.10.0.3 -d 192.168.0.2,10.10.0.4
bittwiste -I changedip.pcap -O changedipandport.pcap -T udp -s 12345,24680 -d 80,8080
If your original capture file only has the IPs and port numbers of your original machines, you can simplify this by not mentioning the old IPs and port numbers in the edit commands, eg
bittwiste -I original.pcap -O changedip.pcap -T ip -s 10.10.0.3 -d 10.10.0.4
bittwiste -I changedip.pcap -O changedipandport.pcap -T udp -s 24680 -d 8080
to generate packets from 10.10.0.3:24680 to 10.10.0.4:8080.
From a machine in your network N2, you should be able to play back the changedipandport.pcap
file using Colasoft Packet Player (http://www.colasoft.com/packet_player) or the commandline BitTwist player, eg
bittwist -i 1 changedipandport.pcap
where the "1" here is device 1. Use bittwist -d
to list the devices.
There are other nifty options with the BitTwist player that you can't do with the Colasoft Packet Player, notably by changing the speed of the packets sent by a multiplier (eg 5 times original speed or 0.1 times original speed).
I have successfully tested this method using Wireshark (http://www.wireshark.org) to capture OSC data (UDP packets) sent from TouchOSC on an i-device to my laptop (via WiFi) at port 8000, using bittwiste (the editor) to change destination IP address to my wired ethernet adapter address and the UDP port to 8001, then replaying using bittwist (the player) to a Pure Data (http://puredata.info) patch listening on port 8001.
ACCEPTED ANSWER
Score 3
tcpreplay (https://tcpreplay.appneta.com/) would also appear be able to do what you want, maybe in a single step using the tcprelat-edit program, but I haven't personally run this software.
From the tcpreplay-edit overview:
tcpreplay has evolved quite a bit over the years. In the 1.x days, it merely read packets and sent then back on the wire. In 2.x, tcpreplay was enhanced significantly to add various rewriting functionality but at the cost of complexity, performance and bloat. Now in 3.x, tcpreplay has returned to its roots to be a lean packet sending machine and the editing functions have moved to tcprewrite and a powerful tcpreplay-edit which combines the two.
Since tcpreplay-edit includes all the functionality of both tcpreplay and tcprewrite please see those wiki pages for how to use tcpreplay-edit.