appneta/tcpreplay

tcprewrite - tcprewrite does not alter output file udp multicast

michalcomprimagic opened this issue · 6 comments

Describe the bug
tcprewrite does not alter port, srcip, dstip ect... in the pcap https://we.tl/t-hgcIa2dGMj

./tcprewrite --srcipmap=10.96.225.227:172.31.22.85 --infile=/home/ec2-user/inputpcap.pcapng --outfile=inputready.pcap

Nothing is changed in output file. Aim is to change the source IP address for all packets

To Reproduce

  1. Install tcpreplay, from tarball, ./configure, make, make install
  2. Use following pcap: https://we.tl/t-hgcIa2dGMj
  3. libpcap up to date

System:
Attempted both with Centos 07, and AWS Linux 2 AMI

I have observed that pcap packets with IPv6 fragmentation do not rewrite (#831)
Is this for all packets, or only certain packets?
Do you have a minimal reproducible pcap that demonstrates the problem?

Hi Chuck, thanks for the fast response.

Yes this is for all packets. You can use the pcap in the link. However the --v flag shows no issue, just prints the pcap packet descriptions without any changes.

Maybe there is an issue with my installation method.... Is there anything I can do to troubleshoot this?

Hey Michal,
I had a similar problem with IPv6 packets with fragment headers (#831),
so this behavior may be caused by a similar issue.
The pcap file you provide is large. Please extract and upload a couple of packets (tcpdump, wireshark/tshark, editcap) here?
https://stackoverflow.com/questions/19633225/how-do-i-get-a-specific-range-of-packets-from-a-large-pcap-file-with-tcpdump

Since PR #832 was merged, please check that branch to see whether the change fixes your problem.

If you have found the problem and it wasn't with tcpreplay, please close the ticket.