A suite of utilities for editing and replaying previously captured network traffic (pcap files) on Unix and Windows systems.
Tcpreplay is a suite of command-line utilities for editing and replaying network traffic from pcap capture files. It solves the problem of testing network hardware and software—like firewalls, IDS/IPS, and NetFlow devices—by allowing users to replay real or modified traffic under controlled conditions to validate performance, security, and functionality.
Network engineers, security researchers, and developers working on network devices (firewalls, IDS/IPS, routers) or network monitoring tools (NetFlow analyzers) who need to test their systems with realistic traffic patterns.
Developers choose Tcpreplay because it offers a comprehensive, open-source alternative to commercial network test equipment, with features like high-speed replay via netmap, detailed flow analysis, and flexible packet editing—all while being widely adopted and trusted in the networking industry.
Pcap editing and replay tools for *NIX and Windows - Users please download source from
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports netmap to bypass kernel network stacks, enabling near-wire-speed performance on 10GigE networks, as noted in the README's build instructions for achieving commercial-grade rates.
Includes multiple utilities like tcprewrite for packet editing and tcpliveplay for live TCP replay, offering flexibility for various testing scenarios, from device validation to application stack testing.
Provides detailed flow statistics and analysis, essential for tuning NetFlow/IP Flow hardware, with enhancements in version 4.0 for increased accuracy and performance reporting.
Used by numerous networking vendors and open-source projects, ensuring reliability and continuous feature development, as mentioned in the README's community support section.
Building with netmap requires specifying source directories and can disrupt other network applications on the test interface, as warned in the README, adding setup overhead.
Only runs on Win32 under Cygwin, lacking native Windows support, which may hinder adoption in environments preferring straightforward installation without additional layers.
Requires mastering multiple command-line tools and options for full workflow (e.g., tcpprep, tcprewrite, tcpreplay), with documentation scattered across man pages and wikis, as indicated in the support section.