Opened 6 years ago

Closed 6 years ago

#491 closed defect (invalid)

tcpreplay, unable to replay pcap file

Reported by: Galinurov Maxim <myfifa@…> Owned by: aturner
Priority: low Milestone:
Component: tcpreplay Version: 3.4.3
Keywords: Cc:
Operating System: Add to FAQ?: yes
Hardware: All
Output of tcpreplay -V: tcpreplay version: 3.4.3 (build 2375) Copyright 2001-2009 by Aaron Turner <aturner at synfin dot net> Cache file supported: 04 Not compiled with libdnet. Compiled against libpcap: 1.0.0 64 bit packet counters: enabled Verbose printing via tcpdump: enabled Packet editing: disabled Fragroute engine: disabled Injection method: PF_PACKET send()

Description

Hi, when I run "tcpreplay -i eth0 'filename'" I receive the following warning : "DLT (LINUX_SLL) does not match that of the outbound interface: eth0 (EN10MB)"...And no packets are being send to the network (and need to monitor SIP and RTP packets)...This is the first time when this warning is raised: all of my other pcap files are played successfully...
How can I solve this one???

Change History (1)

comment:1 Changed 6 years ago by aturner

  • Resolution set to invalid
  • Status changed from new to closed

The error is telling you that your pcap file's DLT encapsulation is LINUX_SLL which generally happens when running "tcpdump -i any". Long story short, LINUX_SLL is *not* like DLT_EN10MB which is more commonly known as Ethernet which is what your eth0 NIC is. Basically this means that the layer 2 header is wrong and replaying that pcap over eth0 would result in gibberish on the wire.

If possible, I recommend re-capturing the traffic using tcpdump/Wireshark but specifying a single NIC. Alternatively, you can use tcprewrite to convert that pcap file from LINUX_SLL to EN10MB.

http://tcpreplay.synfin.net/wiki/tcprewrite#RewritingLayer2

In the future, please don't open tickets to ask questions... that's what the tcpreplay-users list is for. Thanks.

Note: See TracTickets for help on using tickets.