Penetration Testing mailing list archives
Re: TCPReplay problem
From: "Bojan Zdrnja" <bojan.zdrnja () gmail com>
Date: Fri, 28 Apr 2006 20:41:50 +1200
Ankur, On 4/28/06, ankur jindal <ankurjn113 () hotmail com> wrote:
Hi all Can we direct tcpreplay to send packets to another machine? If so what is the command for that. I didnt see any documentation for that. When it sends out packets on an interface is are they just sent to the next ethernet or is tcpreplay used for testing the machine on which it is installed. I assume it shouldn't be the latter case.
tcpreplay does just that - it will replay a captured pcap file. So, whatever the source and destination addresses in the original pcap file were, tcpreplay will put those on the network. This means that, if the packets reach the original destination, only the first SYN packet will have some meaning - the original host will choose a different sequence number than the one which was recorded in the pcap file and the rest of the communication will be dropped by the destination (it will never receive a proper SYN/ACK packet from the source; it will receive one recorded in the pcap file but it will have incorrect sequence number). I presume you want to use the pcap file to run an attack on a destination -- you'll have to use a different tool for that (last time I had to do this I manually crafted attack packets). If you check the roadmap for tcpreplay you will see that some of these features will probably be included in the 3.0 release. Cheers, Bojan ------------------------------------------------------------------------------ This List Sponsored by: Cenzic Concerned about Web Application Security? Why not go with the #1 solution - Cenzic, the only one to win the Analyst's Choice Award from eWeek. As attacks through web applications continue to rise, you need to proactively protect your applications from hackers. Cenzic has the most comprehensive solutions to meet your application security penetration testing and vulnerability management needs. You have an option to go with a managed service (Cenzic ClickToSecure) or an enterprise software (Cenzic Hailstorm). Download FREE whitepaper on how a managed service can help you: http://www.cenzic.com/news_events/wpappsec.php And, now for a limited time we can do a FREE audit for you to confirm your results from other product. Contact us at request () cenzic com for details. ------------------------------------------------------------------------------
Current thread:
- TCPReplay problem ankur jindal (Apr 27)
- Re: TCPReplay problem Bojan Zdrnja (Apr 28)
- Re: TCPReplay problem Graeme Connell (Apr 28)
- <Possible follow-ups>
- Re: Re: TCPReplay problem alphafreq (Apr 30)