pcapreplay

Replays previously captured network traffic. Administrative privileges are required to execute this command.

Syntax

pcapreplay device="DEVICE_NAME" [pps=INT]
Required Parameters
device=DEVICE_NAME
Name of the network device to replay packets among the devices identified by the system pcapdevices command. To specify the interface, specify the name of the device identified as name.
Optional Parameters
pps=INT
Packet replay speed in packets/sec.

Description

For this command to work, a driver such as libpcap or winpcap must be installed, and the Logpresso process must be able to use RAW I/O for the network interface with administrative privileges.

You can use this command by applying it in a way that transmits incoming traffic to the monitor port of the IPS or network traffic analysis device.

To replay the packet data stored in the table in chronological order, you need to apply the order=asc option to the table command to sort the packets in the original chronological order.

Usage

Transmit traffic from the PCAP device enp0s3 at a speed of 1,302,083 pps (about 1 Gbps) after reading the payload field from the record stored in the tapped_traffic table for the last 5 minutes.

table order=asc duration=5m tapped_traffic 
| fields payload 
| pcapreplay device="enp0s3" pps=1302083