Replays previously captured network traffic. Administrative privileges are required to execute this command.
- Name of the network device to replay packets among the devices identified by the system pcapdevices command. To specify the interface, specify the name of the device identified as name.
- Packet replay speed in packets/sec.
For this command to work, a driver such as libpcap or winpcap must be installed, and the Logpresso process must be able to use RAW I/O for the network interface with administrative privileges.
You can use this command by applying it in a way that transmits incoming traffic to the monitor port of the IPS or network traffic analysis device.
To replay the packet data stored in the table in chronological order, you need to apply the
order=asc option to the table command to sort the packets in the original chronological order.
Transmit traffic from the PCAP device
enp0s3 at a speed of 1,302,083 pps (about 1 Gbps) after reading the payload field from the record stored in the
tapped_traffic table for the last 5 minutes.
table order=asc duration=5m tapped_traffic | fields payload | pcapreplay device="enp0s3" pps=1302083