TCPPREP(1)

tcpprep — straight outta the Tcpreplay Suite, manual section 1. Bestie, buckle up. 💅

---

✨ NAME ✨

tcpprep — Create a tcpreplay cache cache file from a pcap file. (yes, it really says "cache cache", we don't make the rules 💀)

---

🌸 SYNOPSIS 🌸

tcpprep [OPTION]...

---

💖 DESCRIPTION 💖

Okay so tcpprep is a pcap(3) file pre-processor, and what it does is it makes a cache file. That cache file is literally a little rulebook for tcprewrite(1) and tcpreplay(1), telling them how to process and send packets. It's giving "manager energy", fr fr. 👑

Here's the vibe: the whole point of tcpreplay is to resend every single packet from the input file(s) out one single file. tcpprep rolls up, looks at a pcap file, applies whatever user-specified rules you gave it, and spits out a cache file. That cache file then tells tcpreplay whether or not to send each packet, and which interface that packet should go out of. Iconic behaviour, honestly. ✨

Wanna go deeper? The Tcpreplay Manual lives at: http://tcpreplay.appneta.com

---

💅 OPTIONS 💅

• -d, --dbug=number — Turn on debugging output. Range: 0 to 5. Default: 0.

If it was configured with --enable-debug, then you get to pick a verbosity level for the debugging output. Bigger numbers = more yapping. 🗣️

• -a, --auto=string — Auto-split mode. Cannot be combined with: --cidr, --port, --regex, --mac.

tcpprep will try to figure out, all on its own, what the primary function of each host is — based on the traffic it captured — and classify every host as either client or server. But bestie, you do have to give it a hint about how to go looking for clients and servers. The valid hints are:

• bridge — Bridge mode goes through each packet trying to figure out if the sender is a client or a server. Once all the packets are processed, the results get weighed according to the server/client ratio (--ratio), and then systems get assigned an interface. If tcpprep can't tell what role a system plays? It aborts. 💀
• router — Router mode works exactly like bridge mode, except after the weighing is done, any system that's still undetermined is considered a server if it falls inside a network that's known to contain other servers. Router has a better shot at successfully splitting clients and servers, but it is not 100% foolproof.
• client — Client mode works exactly like bridge mode, except unclassified systems get treated as clients. Client mode should always complete successfully. 🫶
• server — Server mode works exactly like bridge mode, except unclassified systems get treated as servers. Server mode should always complete successfully.
• first — First mode works by looking at the first time each IP shows up in the SRC and DST fields of the IP header. If the host is first seen in the SRC field, it's a client. If it's first seen in the DST field, it's marked as a server. This basically replicates the processing of the tomahawk test tool. First mode should always complete successfully. ⭐

• -c, --cidr=string — CIDR-split mode. Cannot be combined with: --auto, --port, --regex, --mac.

Hand it a comma delimited list of CIDR netblocks, and it matches them against the source IP of every packet. Any packet that matches one of the CIDRs gets classified as a server.

IPv4 example:

--cidr=192.168.0.0/16,172.16.0.0/12,10.0.0.0/8

IPv6 example:

--cidr=[::ffff:0:0/96],[fe80::/16]

• -r, --regex=string — Regex-split mode. Cannot be combined with: --auto, --port, --cidr, --mac.

Give it a regular expression and it matches that against the source IP of each packet. Packets that match the regex get classified as servers. 🎀

• -p, --port — Port-split mode. Cannot be combined with: --auto, --regex, --cidr, --mac.

Says that TCP and UDP traffic over IPv4 and IPv6 should be classified as client or server based on the destination port of the header.

• -e, --mac=string — Source MAC split mode. Cannot be combined with: --auto, --regex, --cidr, --port.

Give it a list of MAC addresses to match against the source MAC of each packet. Packets matching one of the values get classified as servers.

• --reverse — Matches to be client instead of server.

Normally --mac, --regex and --cidr are used to specify the servers, and non-IP packets get classified as clients. With --reverse, all of that flips: the flags specify clients instead, and non-IP packets get classified as servers. 🔄

• -C, --comment=string — Embedded cache file comment.

Pick a comment to be imbedded inside the output cache file, so you can view it later. Little love note to your future self. 💌

• --no-arg-comment — Do not embed any cache file comment.

By default, tcpprep sticks the arguments you passed on the command line into the cache file comment (on top of whatever --comment you gave it). If for some reason you do not want that, hit this option.

• -x, --include=string — Include only packets matching rule. Cannot be combined with: --exclude.

This overrides the default of processing every packet in the capture file, so instead it only sends/edits packets that match the rule you gave. Rules can be one of:

• S:<CIDR1>,... — Source IP must match specified IPv4/v6 CIDR(s)
• D:<CIDR1>,... — Destination IP must match specified IPv4/v6 CIDR(s)
• B:<CIDR1>,... — Both source and destination IP must match specified IPv4/v6 CIDR(s)
• E:<CIDR1>,... — Either IP must match specified IPv4/v6 CIDR(s)
• P:<LIST> — Must be one of the listed packets, where the list corresponds to the packet number in the capture file.

-x P:1-5,9,15,72-

would process packets 1 through 5, the 9th and 15th packet, and packets 72 until the end of the file

• F:'<bpf>' — BPF filter. See the tcpdump(8) man page for syntax.

• -X, --exclude=string — Exclude any packet matching this rule. Cannot be combined with: --include.

This overrides the default of processing every packet in the capture file, so instead it only sends/edits packets which do NOT match the rule you gave. Rules can be one of:

• S:<CIDR1>,... — Source IP must not match specified IPv4/v6 CIDR(s)
• D:<CIDR1>,... — Destination IP must not match specified IPv4/v6 CIDR(s)
• B:<CIDR1>,... — Both source and destination IP must not match specified IPv4/v6 CIDR(s)
• E:<CIDR1>,... — Either IP must not match specified IPv4/v6 CIDR(s)
• P:<LIST> — Must not be one of the listed packets, where the list corresponds to the packet number in the capture file.

-x P:1-5,9,15,72-

would skip packets 1 through 5, the 9th and 15th packet, and packets 72 until the end of the file

• -o, --cachefile=string — Output cache file.
• -i, --pcap=string — Input pcap file to process.
• -P, --print-comment=string — Print embedded comment in the specified cache file.
• -I, --print-info=string — Print basic info from the specified cache file.
• -S, --print-stats=string — Print statistical information about the specified cache file.
• -s, --services=string — Load services file for server ports. Requires: --port.

Uses a list of ports used by servers, in the same format as /etc/services:

<service_name>        <port>/<protocol> # comment

Example: http 80/tcp

• -N, --nonip — Send non-IP traffic out server interface.

By default, non-IP traffic that can't be classified as client or server gets classified as "client". Specifying --nonip reclassifies non-IP traffic as "server". Heads up though: the meaning of this flag is reversed if --reverse is used. 🙃

• -R, --ratio=string — Ratio of client to server packets. Default: 2.0. Requires: --auto.

Since any given host might have both client and server traffic being sent to/from it, tcpprep uses a ratio to weigh those packets. If you wanna override the default of 2:1 server to client packets required for a host to be classified as a server, just specify it as a floating point value.

• -m, --minmask=number — Minimum network mask length in auto mode. Range: 0 to 32. Default: 30. Requires: --auto.

By default, auto modes use a minimum network mask length of 30 bits to build networks containing clients and servers. This lets you override that value. Larger values will increase performance but may give you inaccurate results. ⚠️

• -M, --maxmask=number — Maximum network mask length in auto mode. Range: 0 to 32. Default: 8. Requires: --auto.

By default, auto modes use a maximum network mask length of 8 bits to build networks containing clients and servers. This lets you override that value. Larger values will decrease performance and accuracy, but will give you a greater chance of success.

• -v, --verbose — Print decoded packets via tcpdump to STDOUT.
• -A, --decode=string — Arguments passed to tcpdump decoder. Requires: --verbose.

When you enable verbose mode (-v), you can also hand over one or more extra arguments to pass to tcpdump, to change the way packets get decoded. By default, -n and -l are used. Make sure you quote the arguments so they don't get interpreted by tcprewrite. The following arguments are valid:

[ -aAeNqRStuvxX ]
[ -E spi@ipaddr algo:secret,... ]
[ -s snaplen ]

• -V, --version — Print version information.
• -h, --less-help — Display less usage information and exit.
• -w, --suppress-warnings — suppress printing warning messages.
• -H, --help — Display usage information and exit.
• --more-help — Pass the extended usage information through a pager.
• --save-opts[=string] — Save the current option state to a config file.
• --load-opts=string, --no-load-opts — Load options from a config file; --no-load-opts disables this.

---

🎀 OPTION PRESETS 🎀

Any option that is not marked as not presettable may be preset by loading values from configuration ("RC" or ".INI") file(s). The homerc file is $$/, unless that is a directory; in that case .tcppreprc is searched for within it. 🦋

---

🌈 FILES 🌈

See OPTION PRESETS for configuration files.

---

⭐ EXIT STATUS ⭐

One of the following exit values will be returned:

• 0 (EXIT_SUCCESS) — Successful program execution. slay. ✅
• 1 (EXIT_FAILURE) — The operation failed or the command syntax was not valid.
• 66 (EX_NOINPUT) — A specified configuration file could not be loaded.
• 70 (EX_SOFTWARE) — libopts had an internal operational error. Please report it to autogen-users@lists.sourceforge.net. Thank you. 🙏

---

💖 AUTHORS 💖

okay so this page has two copyright holders and they're both legends, ngl:

• Copyright 2013-2026 Fred Klassen - AppNeta by Broadcom
• Copyright 2000-2012 Aaron Turner

if you need support, bestie, please use the tcpreplay-users@lists.sourceforge.net mailing list. that's the move. fr fr. 💌

and the latest version of this software is always available from:

http://tcpreplay.appneta.com/

like, always always. go get it. 🦋

---

👑 COPYRIGHT 👑

Copyright © 2000-2026 Aaron Turner and Fred Klassen, all rights reserved.</purl>

This program is released under the terms of the GNU General Public License, version 3 or later. periodt. 💅

---

🐛 BUGS 🐛

Please send bug reports to: tcpreplay-users@lists.sourceforge.net

not me asking you to tell them about the bugs though — they want to know, it's giving responsible disclosure, it's giving community, it's giving slay. 🫶

---

📝 NOTES 📝

This manual page was generated from the tcpprep option definitions.

iykyk — the manpage is literally auto-generated from the source, so if you ever spot something cursed in here, that's why. it's not vibes-based documentation, it's definitions-based documentation. ✨

---

okay that's the whole page bestie, we made it, we read every single line, we are so back. this was Tcpreplay Suite TCPPREP(1), dated 2026-07-29 — go prep some packets, you absolute icon. 🎀💖🌸🦋