--- tcpreplay.8.orig Fri May 17 17:55:47 2002 +++ tcpreplay.8 Fri May 31 11:49:46 2002 @@ -1,5 +1,5 @@ .\" yo there. -.TH TCPREPLAY 8 "2 December 20001" +.TH TCPREPLAY 8 "2 December 2001" .SH NAME tcpreplay \- replay traffic from a saved tcpdump file .SH SYNOPSIS @@ -30,6 +30,9 @@ .B \-l .I loop count ] [ +.B \-n +.I nomartian +] [ .B \-m .I multiplier | @@ -39,6 +42,9 @@ .B \-R .I regex ] +.B \-C +.I cidr1[,cidr2,cidr3] +] .I file .br .ad @@ -67,11 +73,14 @@ .LP This version of .I tcpreplay -supports sending packets out two interfaces. Packets matching the \fIregex\fP -are sent out the \fIprimary interface\fP and all other packets are sent out the -\fIsecondary interface\fP. For improved performance, a tcpprep \fIcache file\fP -can be used instead. Also supported is rewriting of the destination \fIMAC -addresses\fP to allow routers to forward packets between interfaces. Additionally, a slice of packets matching a \fIbegin\fP and \fIend\fP range can be sent from the tcpdump file. +supports sending packets out two interfaces. Packets are matched by using either +a \fIregex\fP, \fICIDR list\fP, or by using the tcpprep pre-processor and associated +\fIcache file\fP. Matching packets are sent out the \fIprimary interface\fP and all +other packets are sent out the \fIsecondary interface\fP. For improved performance, +use either \fICIDR list\fP matching or a tcpprep \fIcache file\fP. Also supported +is rewriting of the destination \fIMAC addresses\fP to allow routers to forward packets +between interfaces. Additionally, a slice of packets matching a \fIbegin\fP and \fIend\fP +range can be sent from the tcpdump file. .SH OPTIONS .LP .TP @@ -103,6 +112,9 @@ Resend the packets at a \fImultiple\fR of the speed at which they were recorded. .TP +.B \-n +Drop packets with \fImartian\fR destination addresses. +.TP .B \-r Resend the packets at the \fIrate\fR specified (in Mbps). .TP @@ -111,6 +123,10 @@ that match this regex are sent via the primary interface. Packets that do not match this regex are sent via the secondary interface. .TP +.B \-C +Specify a comma serpated list of net/masklen to match against the source IP of packets. +Works similar to regex, but is significantly faster. +.TP .SH "SEE ALSO" tcpdump(8) tcpprep(8) .SH AUTHOR @@ -125,8 +141,10 @@ .I tcpreplay can only send packets as fast as your machine's interface, processor, and disk will allow. Use of the -R flag will \fIsignificantly\fP -slow it down. Those worrying about peformance should use \fItcpprep\fP with the --c flag instead. +slow it down. Use of the -C flag will work for most systems with a fast +processor. Those worrying about peformance should use \fItcpprep\fP with the +-c flag instead, however, processesing time may be extremely slow for large +capture files. .LP ``\fIN\fR write attempts failed from full buffers and were repeated'' does not indicate that these packets were not sent, but that the send