TCPREPLAY(1)

📦
version 4.6.2 · 8 versions
, in epel 9

💅 TCPREPLAY(1) — tcpreplay from the Tcpreplay Suite 💅

💖 NAME 💖

  • tcpreplay — Replay network traffic stored in pcap files

✨ SYNOPSIS ✨

tcpreplay [OPTION]... <pcap_file(s)> | <pcap_dir(s)>

🦋 DESCRIPTION 🦋

Okay so, bestie: tcpreplay is the tool for replaying network traffic from files saved with tcpdump or other tools which write pcap(3) files. It's giving packet-girl main character energy, fr fr.

The basic operation of tcpreplay is to resend all packets from the input file(s) at the speed at which they were recorded, or a specified data rate, up to as fast as the hardware is capable. Lowkey iconic.

Optionally, the traffic can be split between two interfaces, written to files, filtered and edited in various ways, providing the means to test firewalls, NIDS and other network devices. Like, it's not just replaying — it's a whole vibe check for your network gear 💅.

On Linux, raw IP (layer 3 only) interfaces such as WireGuard and tun are supported automatically: any layer 2 header in the input file (Ethernet including VLAN tags, Linux SLL, loopback, ...) is stripped and packets are sent as bare IPv4/IPv6. Non-IP packets such as ARP cannot be sent on these interfaces and are reported as failed. Not me crying over an ARP packet that can't come to the party 😭.

For more details, please see the Tcpreplay Manual at: http://tcpreplay.appneta.com

🎀 OPTIONS 🎀

  • -r, --portmap=string — Rewrite TCP/UDP ports. May appear up to 9999 times.

Specify a list of comma delimited port mappings consisting of colon delimited port number pairs. Each colon delimited port pair consists of the port to match followed by the port number to rewrite.

Examples:

--portmap=80:8000 --portmap=8080:80    # 80->8000 and 8080->80
--portmap=8000,8080,88888:80           # 3 different ports become 80
--portmap=8000-8999:80                 # ports 8000 to 8999 become 80
  • -s, --seed=number — Randomize src/dst IPv4/v6 addresses w/ given seed. Cannot be combined with: --fuzz-seed.

Causes the source and destination IPv4/v6 addresses to be pseudo randomized but still maintain client/server relationships. Since the randomization is deterministic based on the seed, you can reuse the same seed value to recreate the traffic. Deterministic chaos, we love to see it ✨.

  • -N, --pnat=string — Rewrite IPv4/v6 addresses using pseudo-NAT. May appear up to 2 times. Cannot be combined with: --srcipmap.

Takes a comma delimited series of colon delimited CIDR netblock pairs. Each netblock pair is evaluated in order against the IP addresses. If the IP address in the packet matches the first netblock, it is rewritten using the second netblock as a mask against the high order bits.

IPv4 Example:

--pnat=192.168.0.0/16:10.77.0.0/16,172.16.0.0/12:10.1.0.0/24

IPv6 Example:

--pnat=[2001:db8::/32]:[dead::/16],[2001:db8::/32]:[::ffff:0:0/96]
  • -S, --srcipmap=string — Rewrite source IPv4/v6 addresses using pseudo-NAT. Cannot be combined with: --pnat.

Works just like the --pnat option, but only affects the source IP addresses in the IPv4/v6 header. Source-only glow-up ✨.

  • -D, --dstipmap=string — Rewrite destination IPv4/v6 addresses using pseudo-NAT. Cannot be combined with: --pnat.

Works just like the --pnat option, but only affects the destination IP addresses in the IPv4/v6 header. Destination-only glow-up 💅.

  • -e, --endpoints=string — Rewrite IP addresses to be between two endpoints. Requires: --cachefile.

Takes a pair of colon delimited IPv4/v6 addresses which will be used to rewrite all traffic to appear to be between the two IP addresses.

IPv4 Example:

--endpoints=172.16.0.1:172.16.0.2

IPv6 Example:

--endpoints=[2001:db8::dead:beef]:[::ffff:0:0:ac:f:0:2]
  • --tcp-sequence=number — Change TCP Sequence (and ACK) numbers /w given seed. Range: 1 to any. Default: 0.

Change all TCP sequence numbers, and related sequence-acknowledgement numbers. They will be shifted by a random amount based on the provided seed. Your TCP conversations are getting a little shuffled, bestie 🌀.

  • -b, --skipbroadcast — Skip rewriting broadcast/multicast IPv4/v6 addresses.

By default --seed, --pnat and --endpoints will rewrite broadcast and multicast IPv4/v6 and MAC addresses. Setting this flag will keep broadcast/multicast IPv4/v6 and MAC addresses from being rewritten. Leave the group-chat broadcast girlies alone 🙈.

  • -C, --fixcsum — Force recalculation of IPv4/TCP/UDP header checksums.

Causes each IPv4/v6 packet to have their checksums recalculated and fixed. Automatically enabled for packets modified with --seed, --pnat, --endpoints or --fixlen.

  • --fixhdrlen — Alter IP/TCP header len to match packet length.

By default, tcpreplay will send packets with the original packet length, However, you may want the packet length revised to minimum packet size. Using this option, tcpreplay will rewrite (fix) the packet length, and recalculate checksums when packet length changes. Caution: undesired packet changes may occur when this option is specified. So like, proceed with your eyes open 👀.

  • -m, --mtu=number — Override default MTU length (1500 bytes). Range: 1 to MAX_SNAPLEN.

Override the default 1500 byte MTU size for determining the maximum padding length (--fixlen=pad) or when truncating (--mtu-trunc).

  • --mtu-trunc — Truncate packets larger then specified MTU.

Similar to --fixlen, this option will truncate data in packets from Layer 3 and above to be no larger then the MTU.

  • -E, --efcs — Remove Ethernet checksums (FCS) from end of frames.
⚠️ Danger, bestie! Note, this option is pretty dangerous! We do not actually check to see if a FCS actually exists in the frame, we just blindly delete the last 4 bytes. Hence, you should only use this if you know know that your OS provides the FCS when reading raw packets. Blindly yeeting 4 bytes is not the flex you think it is 💀.
  • --ttl=string — Modify the IPv4/v6 TTL/Hop Limit.

Allows you to modify the TTL/Hop Limit of all the IPv4/v6 packets. Specify a number to hard-code the value or +/-value to increase or decrease by the value provided (limited to 1-255).

Examples:

--ttl=10
--ttl=+7
--ttl=-64
  • --tos=number — Set the IPv4 TOS/DiffServ/ECN byte. Range: 0 to 255.

Allows you to override the TOS (also known as DiffServ/ECN) value in IPv4.

  • --tclass=number — Set the IPv6 Traffic Class byte. Range: 0 to 255.

Allows you to override the IPv6 Traffic Class field.

  • --flowlabel=number — Set the IPv6 Flow Label. Range: 0 to 1048575.

Allows you to override the 20bit IPv6 Flow Label field. Has no effect on IPv4 packets.

  • -F, --fixlen=string — Pad or truncate packet data to match header length.

Packets may be truncated during capture if the snaplen is smaller then the packet. This option allows you to modify the packet to pad the packet back out to the size stored in the IPv4/v6 header or rewrite the IP header total length to reflect the stored packet length.

  • pad — Truncated packets will be padded out so that the packet length matches the IPv4 total length
  • trunc — Truncated packets will have their IPv4 total length field rewritten to match the actual packet length
  • del — Delete the packet
  • --fuzz-seed=number — Fuzz 1 in X packets. Edit bytes, length, or emulate packet drop. Range: 0 to any. Default: 0.

This fuzzing was designed as to test layer 7 protocols such as voip protocols. It modifies randomly 1 out of X packets (where X = --fuzz-factor) in order for stateful protocols to cover more of their code. The random fuzzing actions focus on data start and end because it often is the part of the data application protocols base their decisions on.

Possible fuzzing actions list:

  • drop packet
  • reduce packet size
  • edit packet Bytes:
    • Not all Bytes have the same probability of appearance in real life. Replace with 0x00, 0xFF, or a random byte with equal likelihood.
    • Not all Bytes have the same significance in a packet. Replace the start, the end, or the middle of the packet with equal likelihood.
  • do nothing (7 out of 8 packets)
  • --fuzz-factor=number — Set the Fuzz 1 in X packet ratio (default 1 in 8 packets). Range: 1 to any. Default: 8. Requires: --fuzz-seed.

Sets the ratio of for --fuzz-seed option. By default this value is 8, which means 1 in 8 packets are modified by fuzzing. Note that this ratio is based on the random number generated by the supplied fuzz seed. Therefore by default you cannot expect that exactly every eighth packet will be modified. Random is random, bestie 🎲.

  • --skipl2broadcast — Skip rewriting broadcast/multicast Layer 2 addresses.

By default, editing Layer 2 addresses will rewrite broadcast and multicast MAC addresses. Setting this flag will keep broadcast/multicast MAC addresses from being rewritten.

  • --dlt=string — Override output DLT encapsulation.

By default, no DLT (data link type) conversion will be made. To change the DLT type of the output pcap, select one of the following values:

  • enet — Ethernet aka DLT_EN10MB
  • hdlc — Cisco HDLC aka DLT_C_HDLC
  • jnpr_eth — Juniper Ethernet DLT_C_JNPR_ETHER
  • pppserial — PPP Serial aka DLT_PPP_SERIAL
  • user — User specified Layer 2 header and DLT type
  • --enet-dmac=string — Override destination ethernet MAC addresses.

Takes a pair of comma deliminated ethernet MAC addresses which will replace the destination MAC address of outbound packets. The first MAC address will be used for the server to client traffic and the optional second MAC address will be used for the client to server traffic.

Example:

--enet-dmac=00:12:13:14:15:16,00:22:33:44:55:66
  • --enet-smac=string — Override source ethernet MAC addresses.

Takes a pair of comma deliminated ethernet MAC addresses which will replace the source MAC address of outbound packets. The first MAC address will be used for the server to client traffic and the optional second MAC address will be used for the client to server traffic.

Example:

--enet-smac=00:12:13:14:15:16,00:22:33:44:55:66
  • --enet-subsmac=string — Substitute MAC addresses. May appear up to 9999 times.

Allows you to rewrite ethernet MAC addresses of packets. It takes comma delimited pair or MACs address and rewrites all occurrences of the first MAC with the value of the second MAC. Example:

--enet-subsmac=00:12:13:14:15:16,00:22:33:44:55:66
  • --enet-mac-seed=number — Randomize MAC addresses. Cannot be combined with: --enet-smac, --enet-dmac, --enet-subsmac.

...it lets you randomize the ethernet MAC addresses of packets, which is basically the same kind of glow-up that --seed gives to IPv4/IPv6 addresses. 💅

  • --enet-mac-seed-keep-bytes=number — randomizes MAC addresses, and this one tells it how many bytes to leave *un*touched while it's doing the --enet-mac-seed thing. Range: 1 to 6. Requires: --enet-mac-seed. 🎀
  • --enet-vlan=string — picks your ethernet 802.1q VLAN tag mode. Long story short: it lets you rewrite ethernet frames so you can slap an 802.1q header onto standard 802.3 ethernet headers, or strip the 802.1q VLAN tag info right off. Two flavours:
    • add — adds an 802.1q VLAN header to the existing 802.3 ethernet header. And if a VLAN header is already there? It just stacks a new VLAN header outside the existing one. Queen behaviour. 👑 Note that you're allowed to run this option multiple times to create more than 2 VLAN headers — but those packets will be valid. At most you should have 2 X 802.1q VLAN tags, or an outer 802.1ad and an inner 802.1q VLAN tag.
    • del — rewrites the existing 802.1q VLAN header as an 802.3 ethernet header. Poof, gone. ✨
  • --enet-vlan-tag=number — the new ethernet 802.1q VLAN tag value. Range: 0 to 4095. Requires: --enet-vlan. Mandatory when --enet-vlan=add is used on packets that aren't already VLAN tagged (so yeah, if they're untagged you have to give a value, no skipping).
  • --enet-vlan-cfi=number — the ethernet 802.1q VLAN CFI value. Range: 0 to 1. Requires: --enet-vlan. When you omit it, the CFI bit of an existing VLAN header is preserved; a newly added tag on a previously untagged packet defaults to 0 (and it prints a one-time notice, so at least it tells you 🙈).
  • --enet-vlan-pri=number — the ethernet 802.1q VLAN priority. Range: 0 to 7. Requires: --enet-vlan. Same deal here: omit it and the priority of an existing VLAN header is preserved; a newly added tag on a previously untagged packet defaults to 0 (one-time notice printed, iykyk).
  • --enet-vlan-proto=string — says which VLAN tag protocol, 802.1q or 802.1ad. It's how you pick the protocol of the added VLAN tags:
    • 802.1q — specifies that 802.1q VLAN headers are to be added. This is the default. 💖
    • 802.1ad — specifies that 802.1ad Q-in-Q VLAN headers are to be added. Heads up though: to make valid packets, input packets must already have 802.1q VLAN headers. No shortcuts.
  • --hdlc-control=number — sets the HDLC control value. The Cisco HDLC header has a 1 byte "control" field, and apparently this should always be 0, but lowkey you can use any 1 byte value. 🦋
  • --hdlc-address=number — sets the HDLC address. The Cisco HDLC header has a 1 byte "address" field which has two valid values:
    • 0x0F — Unicast
    • 0xBF — Broadcast

You can however specify any single byte value. Rules are more like guidelines here.

  • --user-dlt=number — sets the output file DLT type, aka the DLT value of the output pcap file. 🎀
  • --user-dlink=string — rewrites the Data-Link layer with whatever data you specify. May appear up to 2 times. You feed it a series of comma-deliminated hex values which get used to rewrite or create the Layer 2 header of the packets. The first instance of this argument rewrites both server and client traffic, but if you specify this argument a second time, that one gets used for the client traffic. Main character energy for client traffic specifically. 💅

Example:

--user-dlink=01,02,03,04,05,06,00,1A,2B,3C,4D,5E,6F,08,00
  • -d, --dbug=number — enables debugging output. Range: 0 to 5. Default: 0. If it was configured with --enable-debug, then you can specify a verbosity level for debugging output, and higher numbers increase verbosity. Turn it up. 🔥
  • -q, --quiet — quiet mode, bestie. Prints nothing except the statistics at the end of the run. Silence, then the receipts.
  • -T, --timer=string — selects the packet timing mode: select, ioport, gtod, nano. Default: gtod. Here's the menu of packet timing methods you can pick from:
    • nano — uses the nanosleep() API
    • select — uses the select() API
    • ioport — writes to the i386 IO Port 0x80
    • gtod [default] — uses a gettimeofday() loop
  • --maxsleep=number — sleeps for no more then X milliseconds between packets. Default: 0. It sets a limit for the max number of milliseconds tcpreplay will sleep between packets, which effectively prevents those long delays between packets without effecting the majority of packets. Default is disabled. 🧚
  • -v, --verbose — prints decoded packets via tcpdump to STDOUT. 🌸
  • -A, --decode=string — arguments passed to the tcpdump decoder. Requires: --verbose. When you enable verbose mode (-v) you may also specify one or more additional arguments to pass to tcpdump to modify the way packets get decoded. By default, -n and -l are used. Be sure to quote the arguments like -A "-axxx" so they're not interpreted by tcpreplay. Please see the tcpdump(1) man page for a complete list of options. 🙏
  • -K, --preload_pcap — preloads packets into RAM before sending. This option loads the specified pcap(s) into RAM before it starts to send, so replay performance goes up while you eat a startup performance hit. Preloading can be used with or without --loop, and it also suppresses flow statistics collection for every iteration, which can significantly reduce memory usage. Flow statistics are predicted based on options supplied and statistics collected from the first loop iteration. Big brain move. 🧠
  • -c, --cachefile=string — splits traffic via a tcpprep cache file. Requires: --intf2. Cannot be combined with: --dualfile. So if you've got a pcap file you'd like to use to send bi-directional traffic through a device (firewall, router, IDS, etc), then using tcpprep you can create a cachefile which tcpreplay will use to split the traffic across two network interfaces. Two NICs, one vibe. 🦋
  • -2, --dualfile — replays two files at a time from a network tap. Requires: --intf2. Cannot be combined with: --cachefile. If you captured network traffic using a network tap, then you can end up with two pcap files — one for each direction. This option replays these two files at the same time, one on each interface, and inter-mixes them using the timestamps in each. Iconic.
  • -i, --intf1=string — client to server/RX/primary traffic output interface. This option is required. It's the required network interface used to send either all traffic or traffic which is marked as 'primary' via tcpprep. Primary traffic is usually client-to-server or inbound (RX) on khial virtual interfaces. ⭐
  • -I, --intf2=string — server to client/TX/secondary traffic output interface. This is the optional network interface used to send traffic which is marked as 'secondary' via tcpprep. Secondary traffic is usually server-to-client or outbound (TX) on khial virtual interfaces. Generally, it only makes sense to use this option with --cachefile. 💜
  • -w, --write=string — pcap file to receive traffic outputs. Cannot be combined with: --intf2. It's the optional pcap file name used to receive traffic.
  • --include=string — sends only selected packet numbers. Cannot be combined with: --exclude. It overrides the default of processing all packets stored in the capture file and only sends packets that are part of a supplied list of packet numbers:
-x P:1-5,9,15,72-

would skip packets 1 through 5, the 9th and 15th packet, and packets 72 until the end of the file.

  • --exclude=string — sends all but the selected packet numbers. Cannot be combined with: --include. Overrides the default of processing all packets stored in the capture file and only sends packets that are NOT part of a supplied list of packet numbers:
-x P:1-5,9,15,72-

would skip packets 1 through 5, the 9th and 15th packet, and packets 72 until the end of the file.

ngl that example text is copy-pasted between both options in the original — so yes, same example twice, no I'm not confused, it's literally what the page says 💀
  • --listnics — lists available network interfaces and exits. Quick lil peek at your NICs. 👀
  • -l, --loop=number — loops through the capture file X times. Range: 0 to any. Default: 1.
  • --loopdelay-ms=number — delay between loops, in milliseconds. Range: 0 to any. Default: 0. Requires: --loop. Cannot be combined with: --loopdelay-ns.
  • --loopdelay-ns=number — delay between loops, in nanoseconds. Range: 0 to any. Default: 0. Requires: --loop. Cannot be combined with: --loopdelay-ms. By default, tcpreplay will use loop delay with microsecond accuracy (loopdelay-ms). In order to use loop delay with nanosecond accuracy, you need to use nano packet timing mode. Precision girlies rise. ✨
  • --pktlen — overrides the snaplen and uses the actual packet len. By default tcpreplay sends packets based on the size of the "snaplen" stored in the pcap file, which is usually the correct thing to do. But occasionally, tools will store more bytes then they were told to. By specifying this option, tcpreplay will ignore the snaplen field and instead try to send packets based on the original packet length.
⚠️ Bad things may happen if you specify this option. Fr fr, be careful.
  • -L, --limit=number — limits the number of packets to send. Range: 1 to any. Default: -1. By default, tcpreplay sends all the packets, but alternatively you can specify a maximum number of packets to send. 🍓
  • --duration=number — limits the number of seconds to send. Range: 1 to any. Default: -1. By default, tcpreplay sends all the packets, but alternatively you can specify a maximum number of seconds to transmit. ⏳
  • -x, --multiplier=string — modifies replay speed to a given multiple. Cannot be combined with: --pps, --mbps, --oneatatime, --topspeed. You give it a value to modify the packet replay speed. Examples:
2.0 will replay traffic at twice the speed captured
0.7 will replay traffic at 70% the speed captured
  • -p, --pps=string — replays packets at a given packets/sec. Cannot be combined with: --multiplier, --mbps, --oneatatime, --topspeed. You give it a value to regulate the packet replay to a specific packet-per-second rate. Examples:
200 will replay traffic at 200 packets per second
0.25 will replay traffic at 15 packets per minute
  • -M, --mbps=string — replays packets at a given Mbps. Cannot be combined with: --multiplier, --pps, --oneatatime, --topspeed. You give it a floating point value for the Mbps rate that tcpreplay should send packets at. 🌈
  • -t, --topspeed — replays packets as fast as possible. Cannot be combined with: --mbps, --multiplier, --pps, --oneatatime. Maximum speed, zero chill. 💀🔥
  • -o, --oneatatime — replay one packet at a time, each time you hit a key 🫶. Cannot be combined with: --mbps, --pps, --multiplier, --topspeed. Basically it lets you step through one or more packets at a time, like you're walking your traffic through it one lil step at a time 💅.
  • --pps-multi=number — how many packets to send for each time interval. Range: 1 to any. Default: 1. Requires: --pps.

Okay so real talk — when you're trying to yeet packets at very high rates, the gap between packets gets so tiny that sleeping for the required period is genuinely impossible to do accurately 😭. This option lets you send multiple packets per go, which gives you longer sleep times that the system can actually pull off. Big brain energy ✨.

  • --loss=string — simulate random percent packet loss (0-100) 🙈.

Set it to a percentage between 0 and 100 and you'll get packet loss simulated at send time. The loss is random: each packet is independently dropped with the given probability — not a fixed pattern (so no "every Nth packet" nonsense), meaning the actual number dropped will vary a little run to run. Dropped packets aren't sent, and they're not counted as failed.

Examples:

25  will drop approximately one quarter of packets, chosen at random
100 will drop every packet (nothing will be sent)
  • --unique-ip — modify IP addresses each loop iteration to generate unique flows 🦋. Requires: --loop. Cannot be combined with: --seed, --fuzz-seed.

This makes sure IPv4 and IPv6 packets are unique for each --loop iteration. It's done in a way that will not alter packet CRC, so it generally won't affect performance. Net effect? This option will significantly increase the flows/sec generated over multiple loop iterations 👑.

  • --unique-ip-loops=string — how many times to loop before assigning a new unique ip. Requires: --unique-ip.

Number of --loop iterations before a new unique IP gets assigned. Default is 1. Assumes both --loop and --unique-ip, iykyk 🌸.

  • --netmap — write packets directly to a netmap enabled network adapter 🔥.

This feature detects netmap capable network drivers on Linux and BSD systems. If it finds one, the network driver is bypassed for the whole execution duration and network buffers get written to directly. Which means you can hit full line rates on commodity network adapters — similar to the rates commercial network traffic generators flex. Note that bypassing the network driver will disrupt other applications connected through the test interface 😬. See INSTALL for more info.

You can also enable this by specifying an interface as 'netmap:<intf>' or 'vale:<intf>'. For example 'netmap:eth0' specifies netmap over interface eth0.

  • --nm-delay=number — netmap startup delay. Default: 10.

Number of seconds to delay after netmap is loaded — required so interfaces are fully up before netmap transmit. Requires the netmap option. Default is 10 seconds ⏳.

  • --no-flow-stats — suppress printing and tracking flow count, rates and expirations 💀.

Suppresses the collecting and printing of flow statistics. This option may improve performance when you're not using --preload-pcap — otherwise its only function is to suppress printing.

The flow feature tracks and prints statistics of the flows being sent. A flow is loosely defined as a unique combination of a 5-tuple, i.e. source IP, destination IP, source port, destination port and protocol.

Heads up: if --loop is specified, the flows from one iteration to the next will not be unique, unless the packets are altered. Use --unique-ip or tcpreplay-edit to alter packets between iterations 🎀.

  • --flow-expiry=number — number of inactive seconds before a flow is considered expired. Range: 0 to any. Default: 0. Cannot be combined with: --no-flow-stats.

This tracks and reports flow expirations based on flow idle times. The timestamps within the pcap file are what determine the expiry — not the actual timestamp of when packets are replayed. So for example, a value of 30 suggests that if no traffic is seen on a flow for 30 seconds, any subsequent traffic would be considered a new flow, and thereby will increment the flows and flows per second (fps) statistics 🧚.

You can use this to optimize flow timeout settings for flow products. Setting the timeout low may lead to flows being dropped when in fact the flow is just slow to respond 😭. Configuring your flow timeouts too high may increase the resources your flow product needs.

Note: using this option while replaying at higher than original speeds can lead to inflated flows and fps counts.

Default is 0 (no expiry) and a typical value is 30-120 seconds ✨.

  • -P, --pid — print the PID of tcpreplay at startup 💅.
  • --stats=number — print statistics every X seconds, or every loop if '0'. Range: 0 to any.

Note that timed delays are a "best effort" situation — long delays between sending packets may cause equally long delays between printing statistics 🫠.

  • -W, --suppress-warnings — suppress printing warning messages 🙈.
  • --xdp — write packets directly to an AF_XDP enabled network adapter 🔥.

This feature detects AF_XDP capable network drivers on Linux systems that have 'libxdp-dev' and 'libbpf-dev' installed. If detected, the network stack is bypassed and packets are sent directly to an eBPF enabled driver, directly. This lets you achieve full line rates on commodity network adapters, similar to rates achieved by commercial network traffic generators 👑.

  • --xdp-queue=number — which of the adapter's queues to bind the AF_XDP socket to. Range: 0 to 4095. Default: 0. Requires: --xdp.

An AF_XDP socket is bound to a single hardware queue. Queue 0 is used by default; on a multi-queue adapter you may need a different one, since the queue must exist on the adapter and traffic steering may not use queue 0. If the queue doesn't exist, the socket cannot be created 😬.

  • --xdp-no-fallback — fail instead of falling back when AF_XDP is unavailable. Requires: --xdp.

By default, if an AF_XDP socket can't be set up on the interface — the driver has no XDP support at all, or the requested queue doesn't exist — tcpreplay warns and replays using its default injection method instead of failing. Use this to make that case a hard error, which is exactly what you want when benchmarking: a silent change of injection method would change what's being measured 💀.

  • --io-uring — send packets asynchronously via Linux io_uring ⚡.

Available on Linux systems with a kernel that supports io_uring and 'liburing-dev' installed. Packets are still sent through a PF_PACKET raw socket, but sends get submitted asynchronously through an io_uring submission queue — which reduces per-packet syscall overhead and lets the kernel process transmissions while tcpreplay prepares the next packet 🦋.

  • --raw — send packets via a PF_INET raw IP socket instead of PF_PACKET.

By default, tcpreplay injects packets with PF_PACKET, which writes directly to the network driver below the IP stack. Which means locally-generated netfilter/iptables rules (and anything else hooked into the normal Linux IP stack) never see the traffic — even when you replay it on the same host that has those rules configured 😭.

This option instead sends each packet's IP header and payload through a PF_INET raw IP (SOCK_RAW) socket bound to the interface given by --intf1/--intf2, so the kernel's normal IP stack — including netfilter/iptables — processes it like any other locally-generated packet ✨.

The trade-off is L2 fidelity: the kernel builds its own Ethernet framing for the outgoing packet, so the source/destination MAC addresses from the capture are not reproduced, and only IPv4 packets are currently supported. This option is Linux-only and requires appropriate privileges to open a raw socket (typically root or CAP_NET_RAW) 🫶.

  • -V, --version — print version information 💖.
  • -h, --less-help — display less usage information and exit.
  • -H, --help — display usage information and exit.
  • --more-help — pass the extended usage information through a pager 📖.
  • --save-opts[=string] — save the current option state to a config file 💾.
  • --load-opts=string, --no-load-opts — load options from a config file; --no-load-opts disables this.

✨ OPTION PRESETS ✨

Any option that is not marked as not presettable may be preset by loading values from configuration ("RC" or ".INI") file(s) 🎀. The homerc file is $$/, unless that is a directory; in that case .tcpreplayrc is searched for within it.

🌸 FILES 🌸

See OPTION PRESETS for configuration files. That's the whole vibe, bestie 💅.

🦋 EXIT STATUS 🦋

One of the following exit values will be returned, no cap:

  • 0 (EXIT_SUCCESS) — Successful program execution. Slay 👑.
  • 1 (EXIT_FAILURE) — The operation failed or the command syntax was not valid 😭.
  • 66 (EX_NOINPUT) — A specified configuration file could not be loaded.
  • 70 (EX_SOFTWARE) — libopts had an internal operational error. Please report it to autogen-users@lists.sourceforge.net. Thank you 🫶.

💜 AUTHORS 💜

Copyright 2013-2026 Fred Klassen - AppNeta by Broadcom

Copyright 2000-2012 Aaron Turner

For support please use the tcpreplay-users@lists.sourceforge.net mailing list 📬.

The latest version of this software is always available from: http://tcpreplay.appneta.com/

Copyright © 2000-2026 Aaron Turner and Fred Klassen, all rights reserved. This program is released under the terms of the GNU General Public License, version 3 or later.

💀 BUGS 💀

Please send bug reports to: tcpreplay-users@lists.sourceforge.net 🙈.

⭐ NOTES ⭐

This manual page was generated from the tcpreplay option definitions. Yep, the whole thing is literally generated, iconic behavior honestly 🧚.

okay that's the whole page bestie, you made it to the end!! 🎉💖

This one's from the Tcpreplay Suite, dated 2026-10-25, and yes — it's TCPREPLAY(1), section one, main character energy only 👑✨🌸

📦 where this page comes from