Tcpreplay is free. I don't charge for it or for technical support even though I have hundreds of hours and 6+ years of effort put into Tcpreplay. Ohloh claims that there is over $400,000 worth of effort in Tcpreplay, so getting it for free is a pretty damn good deal if you ask me.
I've spent a lot of time writing documentation. On the Tcpreplay website, man pages, readme's and the like. I'm quite proud of the fact that Tcpreplay is one of the better documented open source projects out there. Hence, there is a pretty good chance that the answer to your question has already been documented!
But, there's a downside to all this- I have a very low tolerance for stupid questions or people who email me directly rather then using the tcpreplay-users mailing list. The quickest way to put me in a sour mood is not give me the information requested below. I'm constantly amazed by how many people ask me questions and don't even bother to tell me what version they're using!
Of course, if you want to pay me for technical support, then I promise to be nice and answer the stupidest/laziest questions with a smile. Just email me directly and we can work out per-issue or a yearly support contract. But if you're looking for free support for the software you got for free, then I expect you to put forth a little effort so that I can quickly and accurately answer your question.
Lastly, I'm a big fan of Eric Raymond's How to ask questions the smart way. It's a great document which explains how users (that means you) should ask questions in a way to make it easier for developers to help them.
Show me your Pcap
Additionally, many issues people have are due to the specific nature of their pcap file. If you are unable/unwilling to share that pcap, then I may not be able to help you. If you can't share it publicly, I'm willing to receive it privately and promise not to share it with anyone else. If you can't share your pcap file at all, please state so up front. Also, if I ask you a question in reply, then be sure to answer the question. People asking for help who then are coy about the nature of their problem and/or avoid my questions tend to put me in a bad mood very quickly. As I'm often fond of saying: Help me help you!
Lastly, if whatever you are testing is so top secret you can't tell me what it is or the basics about how it works, then please don't ask me for help. You wouldn't ask a car mechanic to fix your car without letting him look at your car and you shouldn't expect me to be able to help you if you can't/won't tell me about what you're testing or how it works. Of course, if you want to pay me a consulting fee, I'll be happy to sign an NDA and then perhaps you can tell me the details.
It's also worth reading the mailing list archives since there is a good chance that someone else has asked this question before. If none of these options provide you with an answer, I suggest using the mailing list. Note that due to spammers trying to use the list, in order to send an email to the mailing list you must first subscribe to the list. Please do not use the Tcpreplay-Devel list for asking questions; it's for people who want to contribute code to Tcpreplay only.
If you think you found a bug or have a feature request, please open a ticket. Do not use the ticketing system to ask questions.
Emailing The Author
Please do not email the author directly with your questions. Doing so prevents others from potentially helping you and your question/answer from showing up in the list archives. Seriously, directly emailing the author is strongly frowned upon. Instead, please use either the tcpreplay-users mailing list or IRC channel. Also, that means don't ask your questions on my personal blog. If you have a relevant comment to a post that's awesome, but my blog is not a place to ask random tcpreplay questions.
If you are using Tcpreplay for confidential/top secret or whatever and can't use the public mailing list, then please contact me about purchasing a technical support contract to allow for one-on-one support that is governed by a NDA.
What Info We Need
In either case (opening a ticket or emailing the list), we will require some information about your problem in order to help:
If your problem has to do with COMPILING tcpreplay:
- Version of tcpreplay you are trying to compile
- Which compiler and version you're using
- Version and installed location (like /usr or /usr/local) of libnet, libdnet, libpcap and Autogen installed on your system
- Platform (Red Hat Linux 9 on x86, Solaris 7 on SPARC, OS X on PPC, etc)
- ./configure arguments
- Contents of config.log
- Output from 'make'
- Any additional information you think that would be useful.
If your problem has to do with RUNNING tcpreplay or one of the sub-tools:
- Version information (output of -V)
- Command line used (options and arguments)
- Platform (Red Hat Linux 9 on Intel, Solaris 7 on SPARC, etc)
- Make & model of the network card(s) and driver(s) version
- Error message (if available) and/or description of problem
- If possible, attach the pcap file used (compressed with bzip2 or gzip preferred)
- The core dump (with binary) or backtrace if applicable
- Detailed description of your problem or what you are trying to accomplish
- If your problem some how relates to a tcpprep cache file, you should include that too
Please Note: The author of Tcpreplay primarily uses OS X; hence, if you're reporting an issue on another platform, it is important that you give very detailed information as I may not be able to reproduce your issue.
Opening a Ticket
If you would like to report a bug or feature request, please use the New Ticket form. Due to a recent upgrade of the ticking system, you no longer need to register an account and login.
Important: The ticketing system is for bugs and feature requests only, if you need help using Tcpreplay please use the tcpreplay-users mailing list or IRC.
You may be wondering what I mean by "stupid questions". Simply, a question which illustrates you have not even the most basic understanding of the problem you are asking help about. A good example of this would be, "What road do I need to take to drive from New York to London?" There is no answer, because New York and London are on different continents separated by an ocean- clearly the person asking this question hasn't bothered to give their question any thought and/or failed basic geography. Basically, if your question sounds like it came from here it's a stupid question.
The most common kind of "stupid questions" I tend to see are people who don't understand basic networking or aren't aware what their pcap file actually contains. Things like, "Why won't tcpreplay won't replay my Cisco HDLC encapsulated pcap on an ethernet card?" Perhaps because Ethernet isn't at all like Cisco HDLC?
Another common issue are people who don't actually know what information is/isn't in their pcap file, because they never opened it in Wireshark. It amazes me how often people are surprised to learn (from me) that their pcap has truncated packets which is why their IDS/IPS won't find the "attacks"- because the attack isn't even there!
Lastly, asking me questions like, "My super top-secret application (that I can't share with you!) doesn't see the packets that Tcpreplay sends; can you tell me why?" are almost guaranteed to get an unhelpful reply for hopefully obvious reasons.