Openbsd

tcpreplay 輸出到 STDOUT?

  • January 31, 2015
$ tcpreplay tcpdump-2015-01-02-18h-13m.pcap        
ERROR:  The intf1 option is required
tcpreplay (tcpreplay) - Replay network traffic stored in pcap files
USAGE:  tcpreplay [ -<flag> [<val>] | --<name>[{=| }<val>] ]... <pcap_file(s)>

  -q, --quiet                Quiet mode
  -T, --timer=str            Select packet timing mode: select, ioport, rdtsc, gtod, nano, abstime
      --sleep-accel=num      Reduce the amount of time to sleep by specified usec
      --rdtsc-clicks=num     Specify the RDTSC clicks/usec
  -v, --verbose              Print decoded packets via tcpdump to STDOUT
  -A, --decode=str           Arguments passed to tcpdump decoder
  -K, --enable-file-cache    Enable caching of packets to internal memory
      --preload-pcap         Preloads packets into RAM before sending
  -c, --cachefile=str        Split traffic via a tcpprep cache file
  -i, --intf1=str            Server/primary traffic output interface
  -I, --intf2=str            Client/secondary traffic output interface
      --listnics             List available network interfaces and exit$ 
$ pkg_info | grep tcpreplay
tcpreplay-3.4.4p1   resend network traffic saved by tcpdump
$ uname -a
OpenBSD notebook.lan 5.6 GENERIC.MP#333 amd64
$ 

由於wireshark 太耗資源,我需要在tcpreplay 中查看數據包,就像在wireshark 中一樣。**問:**我該怎麼做?

tcpreplay是錯誤的工具。它的工作是生成數據包並將它們發送到網路,而不是將它們的內容顯示到標準輸出。

如果 Wireshark(包括它的命令行實用程序tshark)被認為對您來說太耗資源,那麼可能唯一的其他選擇是tcpdump. 請注意,它的數據包解碼功能不如 Wireshark 豐富,但是……這些額外的功能使 Wireshark 更重。

引用自:https://unix.stackexchange.com/questions/182158