Why packets sent by tcpreplay don't appear on server?

Question

I'm trying to replay pcap file to HTTP server. Before that I'm trying to manually check that I'm using tcpreplay correctly.

I've start netcat -l 12345 to listen on specific port. Let's call it "server" On other machine I've run tcpdump to capture all traffic with destination to the specific port in file dummy.pcap. After that I run netcat on client machine, connect to the "server" and send several messages. I've checked resulted pcap with tshark and it shows that packets were captured.

I've start netcat on server again, and on client I've started tcpreplay:

tcpreplay -d 5 -i eth0 -t dummy.pcap

But nothing appears on netcat console on server. I've tried to run tcpdump on "server" and it shows, that packets is received.

Why packets don't appear in netcat console?

Answer 1

TCPreplay will replay traffic AT a server but it does not actually 'communicate' with servers due to the nature of the TCP protocol. So basically your server is receiving TCP packets but never establishing an actual TCP connection because the replay isn't completing the proper handshake. This is why no TCP sessions are showing up in your netcat.

In my experience this kind of tcpdump is only useful for analysis and if you're concerned about reproducing a sequence of commands/data you need to find a tool specific to your protocol (in my case it involved writing a custom client).

See How to record and replay http interactions?

From tcpreplay wiki:

Sending Traffic to a Server

Problem

You have a pcap capture and would like to replay that traffic at another server.

Solution

First, this will only work with ICMP and UDP traffic. Tcpreplay doesn't support sending TCP traffic at a server because it doesn't synchronize Syn/Ack numbers in the TCP stream.

That said, you'll need to change the destination IP and MAC addresses to match that of the target server. In this case, we'll assume the target server IP is 10.10.1.1 and it's MAC address is 00:01:02:03:04:05.

And their FAQ:

=== Does tcpreplay support sending traffic to a server? === If by ''server'' you mean a daemon (Unix) or service (Windows) which listens on a port (a web or mail server would be common examples), then probably not. The biggest issue is that tcpreplay doesn't understand the state of common protocols like TCP. This means it is unable to syncronize Syn/Ack's to create valid TCP sessions.