0

I want to use tcpreplay to replay a packet trace made of TCP and UPD packets.

Is there a way to attach a timestamp to each outgoing packet, so that I will be able to compute the round trip time once all replies have been received (and dumped)?

Otherwise, which other tool should I use?

Ricky Robinson
  • 21,798
  • 42
  • 129
  • 185

1 Answers1

0

If you sniff traffic at the same time with tcpdump or Wireshark, it will timestamp each packet on the way out and the replies.

Just a warning though, tcpreplay generally doesn't support replaying TCP streams to servers since it doesn't track state of the TCP stream. Generally all you'll get are Reset packets in reply. UDP should generally be ok. ICMP often works. If you want more information, be sure to check out the Tcpreplay FAQ:

http://tcpreplay.synfin.net/wiki/FAQ#Doestcpreplaysupportsendingtraffictoaserver

Aaron Turner
  • 319
  • 1
  • 3
  • Thank you. All I have to do is send my packet trace with a small ttl value. I don't need to recreate any TCP stream in both directions. Would `tcpreplay` be enough for this? My aim is to measure round trip times for each packet sent. So far I've been using `scapy`, but it isn't too reliable when it comes to respecting the input packet rate (it's slower) and keeping track of timestamps for request/response packet pairs (delays are sometimes large, every once in a while even negative!!) – Ricky Robinson Feb 11 '13 at 09:47
  • Ok, I wasn't too clear. I forge the TTL value of each packet to a small value so that it triggers an ICMP packet, with which I compute the RTT. That's why I don't need to keep/maintain any TCP connection. – Ricky Robinson Feb 11 '13 at 14:29
  • 1
    Honestly, I'm not sure why you just don't use ping if all you're trying to do is measure RTT. The problem with tcpreplay is that it doesn't ever "read" from the network so it will never see the replies. You'll need something else to do that, hence me suggesting tcpdump/Wireshark. But if you're looking to write code, you can use libpcap to watch the packets being sent in both directions in order to calculate the RTT. – Aaron Turner Feb 11 '13 at 18:59
  • In the end I did as you said: I used tcpreplay for packet replaying and tcpdump to capture outgoing and incoming packets and thus keep track of each timestamp. – Ricky Robinson Jul 18 '13 at 12:17