tcpreplay

No entries match these filters. Clear filters

1. v4.6.1 Aug 15, 2026 · issue 046

   tcpreplay 4.6.1 adds a continuous OSSOSSOpen-source software: code whose licence permits anyone to inspect, modify, and redistribute it. Cyber tools build on it to reuse auditable libraries without licensing fees.-Fuzz pipeline with three libFuzzer targets and removes --xdp-batch-size.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.6.1 https://github.com/appneta/tcpreplay.git
   # already have the repo? check out this version:
   $ git checkout v4.6.1

   • Adds three libFuzzer targets (fuzz_pcap, fuzz_fragroute, fuzz_services) under test/fuzz/, built against ASan/UBSan and submitted to OSS-Fuzz for continuous fuzzing of the pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. parser, fragroute rules engine, and tcpprep --services parser.
   • UBSan now runs alongside ASan in CI, catching misaligned-access bugs; wire-format header structs are now marked packed, hardening packet parsers against a class of defects ASan alone misses.
   • Adds a dependency-free unit test suite under test/unit/, runnable via make check or ctest.

   3 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --xdp-batch-size flag has been removed; any script or config that passes it will fail on upgrade.
2. v4.6.0 Jul 28, 2026 · issue 028

   tcpreplay 4.6.0 adds AF_XDPAF_XDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. and io_uring injection backends, --loss simulation, --raw socket path, and a static libtcpreplay library.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.6.0 https://github.com/appneta/tcpreplay.git
   # already have the repo? check out this version:
   $ git checkout v4.6.0

   └──▷ TRY IT
   Saturate a 1GigE link using the AF_XDP kernel-bypass backend; fall back automatically if the adapter lacks native XDPXDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. support.
   copy

   $ tcpreplay --xdp -i eth0 capture.pcap

   Benchmark AF_XDP on a specific queue without silent fallback masking results — fail loudly if XDP can't be used.
   copy

   $ tcpreplay --xdp --xdp-no-fallback --xdp-queue 2 -i eth0 capture.pcap

   Simulate a lossy link by randomly dropping 10% of packets during replay to stress-test application resilience.
   copy

   $ tcpreplay --loss 10 -i eth0 capture.pcap

   • Adds --xdp AF_XDP injection backend, now reaching ~941 Mbps (305k pps) line rate on 1GigE hardware — a 23× improvement over the previous implementation.
   • Adds --xdp-queue to bind the AF_XDP socket to a specific adapter queue instead of always using queue 0.
   • Adds --xdp-no-fallback to fail hard rather than silently fall back to the default injector — useful for benchmarking where a silent injector change would invalidate results.
   • Adds --xdp-batch-size for tuning AF_XDP batch depth on very high-speed links (100GigE+) with small packets.
   • Adds --io-uring injection backend that batches sends 64 deep via Linux io_uring, reducing per-packet syscall count 64× for ~11% less CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. per packet.

   +5 more show less

   • Adds --raw PF_INET/SOCK_RAW injection path that routes packets through the kernel IP stack (routing, netfilter); IPv4-only, rebuilds L2 framing.
   • Adds --loss flag for random percent packet-loss simulation (0–100%), enabling testing against non-ideal network conditions.
   • Adds support for replaying onto raw IP (L3-only) interfaces such as WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. and tun, which have no L2 header.
   • Installs the replay engine as libtcpreplay, a standalone static C library.
   • Adds CMake build system (cmake -B build && cmake --build build) as an alternative to autotools, with full feature parity.

   10 details in Everything

3. v4.6.0 Jul 28, 2026 · issue 005

   tcpreplay 4.6.0 adds AF_XDPAF_XDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. and io_uring injection backends, --loss simulation, --raw socket path, and a static libtcpreplay library.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v4.6.0 https://github.com/appneta/tcpreplay.git
   # already have the repo? check out this version:
   $ git checkout v4.6.0

   └──▷ TRY IT
   Saturate a 1GigE link using the AF_XDP kernel-bypass backend; fall back automatically if the adapter lacks native XDPXDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. support.
   copy

   $ tcpreplay --xdp -i eth0 capture.pcap

   Benchmark AF_XDP on a specific queue without silent fallback masking results — fail loudly if XDP can't be used.
   copy

   $ tcpreplay --xdp --xdp-no-fallback --xdp-queue 2 -i eth0 capture.pcap

   Simulate a lossy link by randomly dropping 10% of packets during replay to stress-test application resilience.
   copy

   $ tcpreplay --loss 10 -i eth0 capture.pcap

   • Adds --xdp AF_XDP injection backend, now reaching ~941 Mbps (305k pps) line rate on 1GigE hardware — a 23× improvement over the previous implementation.
   • Adds --xdp-queue to bind the AF_XDP socket to a specific adapter queue instead of always using queue 0.
   • Adds --xdp-no-fallback to fail hard rather than silently fall back to the default injector — useful for benchmarking where a silent injector change would invalidate results.
   • Adds --xdp-batch-size for tuning AF_XDP batch depth on very high-speed links (100GigE+) with small packets.
   • Adds --io-uring injection backend that batches sends 64 deep via Linux io_uring, reducing per-packet syscall count 64× for ~11% less CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. per packet.

   +5 more show less

   • Adds --raw PF_INET/SOCK_RAW injection path that routes packets through the kernel IP stack (routing, netfilter); IPv4-only, rebuilds L2 framing.
   • Adds --loss flag for random percent packet-loss simulation (0–100%), enabling testing against non-ideal network conditions.
   • Adds support for replaying onto raw IP (L3-only) interfaces such as WireGuardWireGuardA modern VPN protocol and Linux kernel module, maintained as an open-source project, that establishes encrypted tunnels using minimal code and fast cryptography, giving cyber tools a lightweight, high-performance transport layer. and tun, which have no L2 header.
   • Installs the replay engine as libtcpreplay, a standalone static C library.
   • Adds CMake build system (cmake -B build && cmake --build build) as an alternative to autotools, with full feature parity.

   10 details in Everything

4. advisory CVE-2026-102897 Jul 24, 2026 · issue 128
   • CVE-2026-102897: Heap Out-of-Bounds Read up via --pktlen combined with --preload-pcap in tcpreplay (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.7, affects <= 4.6.0-beta2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
5. advisory CVE-2026-102898 Jul 24, 2026 · issue 128
   • CVE-2026-102898: Heap Out-of-Bounds Write in ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. Address Rewriting via Unvalidated ar_hln/ar_pln (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.1, affects <= 4.6.0-beta2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
6. advisory CVE-2026-102896 Jul 24, 2026 · issue 128
   • CVE-2026-102896: Stack Buffer Overflow in tcpprep --services File Parser via Unbounded Regex Match Copied with strncpy() (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 7.8, affects <= 4.6.0-beta2)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
7. advisory CVE-2026-102754 Jul 24, 2026 · issue 128
   • CVE-2026-102754: SEGV in DLT_JUNIPER_ETHER Plugin When Used as Decoder (affects <= 4.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
8. advisory CVE-2026-102752 Jul 24, 2026 · issue 128
   ⤢
   • CVE-2026-102752: Double free in tcpedit_dlt_cleanup in tcprewrite (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 4.0, affects <= 4.5.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
9. advisory CVE-2026-102753 Jul 24, 2026 · issue 128
   • CVE-2026-102753: Heap-Buffer-Overflow in tcpreplay's get_layer4_v6 Function (affects <= 4.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
10. advisory CVE-2026-102751 Jul 24, 2026 · issue 128
    • CVE-2026-102751: NULL Pointer Dereference in remove_settings (affects <= 4.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
11. advisory CVE-2026-102749 Jul 24, 2026 · issue 128
    • CVE-2026-102749: Heap buffer overflow in tcprewrite fragroute ip6_opt module when inserting IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. extension headers (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.4, affects <= 4.5.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
12. advisory CVE-2026-102746 Jul 23, 2026 · issue 128
    • CVE-2026-102746: Heap Buffer Overflow via Negative Fragment/Segment Size in fragroute tcp_seg/ip_frag Modules (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 8.4, affects <= 4.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
13. advisory CVE-2026-102747 Jul 23, 2026 · issue 128
    • CVE-2026-102747: Out-of-Bounds Write in tcprewrite Fragroute Rules Parser on an Empty Rules File (affects <= 4.5.4)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
14. v4.5.1 Jul 12, 2024 · release notes

    tcpreplay v4.5.1 adds AF_XDPAF_XDPA Linux kernel interface that hands raw packets to a userspace program straight off the network card, skipping the kernel's networking stack. It is how userspace tools reach line rate on 100G links. line-rate transmission, -w pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. output, and --include/--exclude packet filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.5.1 https://github.com/appneta/tcpreplay.git
    # already have the repo? check out this version:
    $ git checkout v4.5.1

    • Adds -w <file> tcpreplay option to write replayed packets directly to a PCAP file instead of transmitting them over an interface.
    • Adds --include and --exclude tcpreplay options to specify specific packet numbers for selective replay.
    • Adds --fixhdrlen tcpreplay option to control handling of packet length changes during replay.
    • Adds -W tcpreplay option to suppress warnings during packet replay.
    • Adds AF_XDP socket support via libxdp API, enabling line-rate transmission on newer Linux kernels without third-party modules like netmap or PF_RING.

    +1 more show less

    • Adds support for SLL2 (Linux cooked capture encapsulation v2) format.

    6 details in Everything

15. v4.3.0 Nov 10, 2018 · release notes

    Adds TCP sequence and ACK number editing capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.3.0 https://github.com/appneta/tcpreplay.git
    # already have the repo? check out this version:
    $ git checkout v4.3.0

    └──▷ USE IT
    Replay a captured PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. with modified TCP sequence and acknowledgment numbers for testing or emulation.
    shell copy

    tcpreplay --edit -S <source_seq> -A <source_ack> -s <snaplen> capture.pcap

    • tcpreplay: Adds ability to change TCP SEQ/ACK numbers with new options

    1 detail in Everything

16. v4.2.5 May 8, 2017 · release notes

    Adds --fuzz-factor option to specify fuzz ratio

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.2.5 https://github.com/appneta/tcpreplay.git
    # already have the repo? check out this version:
    $ git checkout v4.2.5

    └──▷ USE IT
    Specify a fuzz ratio when replaying traffic.
    shell copy

    tcpreplay --fuzz-factor=0.5 capture.pcap

17. v4.2.0 Mar 20, 2017 · release notes

    Adds MAC rewriting, IP loop modification, packet fuzzing, and per-loop stats to tcpreplay v4.2.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.2.0 https://github.com/appneta/tcpreplay.git
    # already have the repo? check out this version:
    $ git checkout v4.2.0

    └──▷ USE IT
    Generate distorted packet traffic with a specific fuzzing seed for testing resilience.
    shell copy

    tcpreplay --fuzz-seed=12345 -i eth0 capture.pcap

    Modify IP addresses cyclically during replay to test load balancer or routing state handling.
    shell copy

    tcpreplay --unique-ip-loops=5 -i eth0 capture.pcap

    Get granular per-loop performance metrics to debug replay synchronization issues.
    shell copy

    tcpreplay --stats=0 -i eth0 capture.pcap

    • Adds --fuzz-seed option for packet distortion capabilities
    • Adds --unique-ip-loops option to modify source/destination IPs every few loops
    • Allows fractional values for the --pps (packets-per-second) option
    • Prints per-loop statistics when using --stats=0 in tcpreplay output

    4 details in Everything

18. v4.1.1 Jan 11, 2016 · release notes

    Adds --unique-ip with duration support, tap device support for Linux/FreeBSD, and loopback SLL handling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.1 https://github.com/appneta/tcpreplay.git
    # already have the repo? check out this version:
    $ git checkout v4.1.1

    └──▷ USE IT
    Send traffic from a pcappcapA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. file with unique IPs for a specific duration using the new option combination.
    shell copy

    tcpreplay --unique-ip --duration=60 capture.pcap

    • --unique-ip now accepts --duration to control the time window for IP variation.
    • Adds Tap device support for Linux and FreeBSD via new contributor Murat Demirten.
    • Handles loopback for Linux cooked capture files (Linux SLL) via corentin-p1 contribution.

    3 details in Everything

19. v4.1.0 Dec 17, 2014 · release notes

    Adds --qtx-bypass kernel module for wire-rate TX on Linux and --netmap-delay flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.1.0 https://github.com/appneta/tcpreplay.git
    # already have the repo? check out this version:
    $ git checkout v4.1.0

    └──▷ TRY IT
    Customize the delay interval for netmap operations when using QTX bypass.
    copy

    $ tcpreplay --qtx-bypass --netmap-delay 50 capture.pcap

    • Enables the Quick TX (qtx) bypass module via TCREPLAY_OPT_QTX_BYPASS or compile-time ENABLE_QTX to write directly to the network driver, achieving wire-rate transmissions up to 10Gbps
    • Adds --netmap-delay CLI argument to customize netmap delay intervals

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Quick TX (qtx) is disabled by default; you must enable it via ENABLE_QTX=1 during build or set TCREPLAY_OPT_QTX_BYPASS=1 at runtime to use wire-rate bypass features
20. v4.0.0 Jan 5, 2014 · release notes

    v4.0.0 adds netmap driver support for 10Gbps wire-speed replay and NetFlow capture generation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v4.0.0 https://github.com/appneta/tcpreplay.git
    # already have the repo? check out this version:
    $ git checkout v4.0.0

    • --mbps option now enables high-accuracy, high-performance transmission rates.
    • New --netmap mode utilizes netmap network drivers to achieve 10GigE wire-speed replay rates.

    2 details in Everything