TOC(depth=2, WikiStart, Download, Docs, Support)?

The basic idea behind libtcpedit (or just tcpedit for short) is to move all the packet editing functionality previously in tcpreplay (2.x), tcprewrite (3.x) and tcpbrige into a single library with a simple API. Eventually, tcpedit will be packaged along with tcpreplay so that other projects can use it.

Go here for information about libtcpedit's design.


As of Tcpreplay 4.0 there are two main methods of working with libtcpedit:

AutoOpts API Example

If you are using GNU AutoOpts to parse your config file or CLI options, then configurating libtcpedit is easy as calling tcpedit_post_args().

Below is (most of) the main() function from tcprewrite.c which uses libtcpedit to modify packets. Hopefully it illustrates just how easy it is to add the power of libtcpedit to any program.

#include "tcprewrite.h"
#include "tcprewrite_opts.h"
#include "tcpedit/tcpedit.h"
#include "tcpedit/parse_args.h"

tcprewrite_opt_t options;
tcpedit_t *tcpedit;
int main(int argc, char *argv[])
    int optct, rcode;

    /* call autoopts to process arguments specific to tcprewrite */
    optct = optionProcess(&tcprewriteOptions, argc, argv);
    argc -= optct;
    argv += optct;

    /* parse the tcprewrite args */
    post_args(argc, argv);
    /* init our tcpedit context */

    if (tcpedit_init(&tcpedit,, NULL) < 0) {
        errx(1, "Error initializing tcpedit: %s", tcpedit_geterr(tcpedit));
    /* parse the libtcpedit args */
    rcode = tcpedit_post_args(tcpedit);
    if (rcode < 0) {
        errx(1, "Unable to parse args: %s", tcpedit_geterr(tcpedit));
    } else if (rcode == 1) {
        warnx("%s", tcpedit_geterr(tcpedit));

    /* validate the options given the DLT type(s) of the input pcap(s) */    
    if (tcpedit_validate(tcpedit) < 0) {
        errx(1, "Unable to edit packets given options/DLT types:\n%s",

    /* rewrite all the packets */
    if (rewrite_packets(tcpedit,, options.pout) != 0)
        errx(1, "Error rewriting packets: %s", tcpedit_geterr(tcpedit));

    /* close the in/output pcap filehandles */

    return 0;

Configuration API

Using AutoOpts is simple, but sometimes it won't work because:

  • You're building a GUI, so parsing CLI options is a non-starter
  • You need your code to build on systems AutoOpts doesn't support (like Windows)
  • You want more control

In these cases, instead of calling tcpedit_post_args() you'll need to use configuration API which is broken out into 2 main parts:

The key things about the configuration API are:

  1. Remember to call tcpedit_init() before and tcpedit_validate() afterwords
  2. If you want to change the DLT type of the pcap, you will need to select it via: tcpedit_set_encoder_dltplugin_byid() or tcpedit_set_encoder_dltplugin_byname()
  3. You need to select the encoder dltplugin before any calls to any of it's setter functions
  4. Each setter, returns TCPEDIT_OK or TCPEDIT_ERROR. On error, you can use tcpedit_geterr() to get more info. Currently, no calls return TCPEDIT_SOFT_ERROR or TCPEDIT_WARN.
Last modified 11 years ago Last modified on 09/09/09 04:38:54