22 lines
1.1 KiB
Text
22 lines
1.1 KiB
Text
Tcpreplay is aimed at testing the performance of a Network Intrusion Detection
|
|
System by replaying real background network traffic in which to hide attacks.
|
|
|
|
Tcpreplay allows you to control the speed at which the traffic is replayed,
|
|
and can replay arbitrary libpcap traces.
|
|
|
|
Unlike programmatically-generated artificial traffic which doesn't exercise
|
|
the application/protocol inspection that a NIDS performs, and doesn't
|
|
reproduce the real-world anomalies that appear on production networks
|
|
(asymmetric routes, traffic bursts/lulls, fragmentation, retransmissions,
|
|
etc.), tcpreplay allows for exact replication of real traffic seen on real
|
|
networks.
|
|
|
|
Tcpprep is tcpreplay with patches can send traffic out two network cards,
|
|
however it requires the calculations be done in real-time. These calculations
|
|
can be expensive and can significantly reduce the throughput of tcpreplay.
|
|
|
|
tcpprep is a libpcap pre-processor for tcpreplay which enables this
|
|
feature in tcpreplay, and significantly increases throughput through
|
|
the use of a cache file.
|
|
|
|
WWW: http://synfin.net/aturner/tcpreplay/
|