tcpreplay 1.4
-------------

tcpreplay is a tool to replay saved tcpdump or snoop files at 
arbitrary speeds.

This program was written in the hopes that a more precise testing
methodology might be applied to the area of network intrusion
detection, which is still a black art at best. 

Many NIDSs fare poorly when looking for attacks on heavily-loaded
networks. tcpreplay allows you to recreate real network traffic from a
real network for use in testing.

What's included with tcpreplay?
-------------------------------

tcpreplay - the tool for replaying capture files
tcpprep - a capture file pre-processor for creating cache files for tcpreplay
capinfo - the tool for printing statistics about capture files
pcapmerge - a tool to merge two or more pcap files into one

What systems does tcpreplay support?
-------------------------------------

tcpreplay has been successfully tested on

	- OpenBSD 2.x, 3.x
	- FreeBSD 4.x
	- BSD/OS 3.x
	- Red Hat Linux 6.x, 7.x, 8.x
	- Solaris 2.7 (SPARC)
	- OS/X (PPC)

Who can use tcpreplay?
-----------------------

tcpreplay is licensed under a BSD-style license, as in the included
LICENSE file. Please read the license to make sure it's okay to use it
in your circumstances.

Contact info?
-------------

The primary tcpreplay site is:

	http://www.sourceforge.net/projects/tcpreplay/

Please send bug reports, comments, or questions about this software to
<[email protected]>.

Building tcpreplay
-------------------

As of version 1.4, tcpreplay now only supports Libnet v1.1 which is available
at:

	http://www.packetfactory.net/Projects/libnet/

Note: tcpreplay 1.3 is the last version to support libnet 1.0.  

To build tcpreplay on a supported platform:

	% ./configure ; make

Note: A variety of optional parameters are available for ./configure which
may be necessary on certain systems.  Run: ./configure --help for details.

Testing tcpreplay
------------------

Tcpreplay now comes with a series of tests to verify that everything is
ok.  While it won't find every possible bug, it will find "stupid stuff".

To test tcpreplay, as root:

	# make test -i

Installing tcpreplay
---------------------

To install tcpreplay, as root:

	# make install

This will install the binaries and man pages into /usr/local/ 
(by default).

On BSD-based systems, kernel modifications are required to correctly
forge outgoing Ethernet source MACs. See the libnet documentation for
details on how to do this.

Known Problems
---------------

Tcpreplay can only replay traffic as fast as your hardware allows. If
you find you can't hit that 80 Mbps traffic rate you want, build a
faster machine (disk I/O seems to account for a lot of the overhead).

Reporting Bugs
---------------

Tcpreplay has a bug tracking system on SourceForge.net, which can be
accessed via:

https://sourceforge.net/tracker/?group_id=48862&atid=454735

Authors
--------

Tcpreplay was originally written by Matt Undy of Anzen Computing.
Tcpreplay has been re-written and is now maintained by Matt Bing 
<[email protected]> and Aaron Turner <[email protected]>
Tcpprep was written and is now maintained by Aaron Turner.
Capinfo was written and is now maintained by Matt Bing.

$Id: README,v 1.9 2002/12/23 06:00:40 aturner Exp $