Shulou(Shulou.com)06/01 Report--

This article mainly introduces how to use the tcpreplay command in Linux. It is very detailed and has a certain reference value. Friends who are interested must finish it!

Linux common commands to put it simply, tcpreplay is a pcap package playback tool, it can use ethreal, wireshark tools to capture the package as it is or after any modification to replay it.

Tcpreplay resends the PCAP package for performance or functional testing

Add that it allows you to make arbitrary changes to the message (mainly refers to the layer 2, layer 3, layer 4 headers), specify the speed of replay the message, etc., so that tcpreplay can be used to reproduce the situation of the packet to locate the bug, and replay it at a very fast speed to achieve stress testing.

Option-A "" in the use of tcpdump-style printout information, and then call the parameters in tcpdump, the default has been with "- n ip", so generally see is the ip address, and there is no hostname printing, note that this is used in the tcpreplay using the-v parameter, without-v will not report an error, but of no practical significance. Format:-vA "nnt" means that the message is output in tcpdump style, and the timestamp, hostname, port service name are not printed. Be careful not to use the-c parameter to specify the number of data packets to be printed, so that fewer messages will be sent. -c dual Nic playback message required parameters, followed by the cache file name, which is constructed for tcpprep according to the corresponding pcap file. -D writes the application layer data to the specified file using dump mode, which is used together with the-w and-W parameters. -e specify the ip of the endpoint, that is, modify the ip of both the sending and receiving messages to the ip specified in the corresponding parameter values, but the messages sent in this way will not distinguish between client and server. -f specifies the configuration file. -F automatically corrects the wrong checksum when sending a message. Check the checksum of the test DUT. -h displays the help file. -I dual network card playback message required parameters to specify the main interface. -I rewrite the destination MAC address of the message sent by the primary network card. -j dual network card playback message required parameters, specify the slave interface. -J rewrites the destination MAC address of the message sent from the network card. -k rewrite the source MAC address of the message sent by the primary network card. -K rewrites the source MAC address of the message sent from the network card. -l specifies the number of cycles. -L specifies the maximum number of packages sent. Can be used when confirming the debugging of the connection. -m specifies a multiple value, that is, how many times faster the default sending rate must be. Increasing the sending rate may mean more concurrent connections and connections for DUT, especially for the playback of BT messages, because the connection timeout is fixed, and if the rate increases, the number of connections left in the session table increases, and this can be achieved by modifying the connection timeout. -M means that the ip message of "Mars" is not sent, and the definition in the man file is 0max 8, 172 max 8, 255 max 8. -n is using the-S parameter and does not listen for promiscuous modes. -N rewrites the IP address through a forged NAT. This parameter should have a very important application and is not currently used in testing. -O is not used for testing. -p specify the number of messages sent per second, specify this parameter, other rate-related parameters are ignored, and the final print information will not have the statistics of rate and messages sent per second. -P means to print PID information in the output to pause and restart the program in single-user or single-account mode. -r specifies the rate at which to send. At present, the relationship between the three parameters-m/-r/-p. -R allows the network card to send packets at the maximum speed. -t specifies MTU, and the default value of the standard 10max 100m Nic is 1500. -T Truncate packets > truncate the part of the message whose MTU is greater than the standard value before sending it. By default, it will not be sent and skip will be dropped. Each time a message is sent, the corresponding message is printed in the style of tcpdump. -V check the version number. -w writes the message sent by the primary network card to a file, followed by the file name immediately after the parameter. Example 1. Replay the message on the client ftp connection

A. Use ethereal to grab the package on the client side and save it as a ftp.pcap file.

B, tcpprep the ftp.pcap file to make the cache file.

[root@A] # tcpprep-an client-I ftp.pcap-o ftp.cache-vc, connect two interfaces of DUT equipment and two interfaces of PC using network cable, and use tcpreplay to replay messages. Notice that the firewall is configured in bridge (transparent) mode.

[root@A] # tcpreplay-c ftp.cache-I eth0-j eth2 ftp.pcap-R-VMurR parameter indicates full speed transmission, and-v displays print information.

2. Replay the message on the client BT connection

Download some Taiwanese entertainment programs and popular blockbusters in the laboratory BT, grab the package using ethereal, and save it as a bt.pcap file. Pay attention to the pcap file size control, the memory requirements of pc is relatively high, I saved a 600m pcap file took more than 40 minutes, you can directly from the laboratory copy.

B, tcpprep the bt.pcap file to make the cache file.

[root@A] # tcpprep-an client-I bt.pcap-o bt.cache-C "100m BT Packet"-v make the cache file and write the comment "100m BT Packet" in the cache file.

C. Use tcpreplay to replay the message.

[root@A ~] # tcpreplay-c bt.cache-I eth0-j eth2 bt.pcap-v-R3, replay the message caught on the tftp server

Use ethereal to grab the package on the tftp server and save it as a tftp.pcap file.

B, tcpprep the pcap file and make the cache file.

[root@A] # tcpprep-an server-I tftp.pcap-o tftp.cache-v Note: I made a mistake in the test. I used DUT's tftp upgrade to do the experiment, and at the same time I replayed the message through DUT. As a result, after the network card sent the message, the mac address of DUT made a response, resulting in the interaction process did not go through DUT. This problem is quite funny. It took a long time in the morning to find out why. At first I thought the udp connection could not be replayed.

C. Use tcpreplay to replay the message.

[root@A] # tcpreplay-c tftp.cache-I eth0-j eth2 tftp.pcap-v is all the contents of the article "how to use tcpreplay commands in Linux". Thank you for reading! Hope to share the content to help you, more related knowledge, welcome to follow the industry information channel!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.