CODEWITHSUNDEEP
linuxnetwork-programming
johnklee
johnklee

Reputation: 2270

Rewrite pcap destination ip with tcprewrite

I try to rewrite the destination ipv6 of pcap with below command:

tcprewrite --infile=v6Capture_d80095.pcap --outfile=test.pcap --dstipmap=[ff02::16],[fe80::20c:29ff:fe4c:84f2]

But got the error message:

Fatal Error: Unable to parse args: From parse_args.c:tcpedit_post_args() line 89:
Unable to parse --dstipmap=[ff02::16],[fe80::20c:29ff:fe4c:84f2]

Any suggestion?

Thanks in advance!

Upvotes: 1

Views: 8038

Answers (3)

Bob
Bob

Reputation: 1075

Here's an example for IPv4:

tcprewrite --dstipmap=111.111.111.111:127.0.0.1 --infile=in.pcap --outfile=out.pcap

Reference documentation: https://tcpreplay.appneta.com/wiki/tcprewrite#changing-networks-via-pseudo-nat-sourcedestination-ip-map

Upvotes: 0

Lashgari
Lashgari

Reputation: 41

In this problem you need to translate once to layer 2 and then re-translate to layer 3:

sudo tcprewrite --infile=in.pcap --dlt=enet --outfile=out.pcap --enet-dmac=00:55:22:33:AA:27 --enet-smac=00:44:66:AC:H9:AF

and then just change the ip address with:

sudo tcprewrite --infile=out.pcap --outfile=new.pcap --dstipmap=192.168.20.20:192.168.50.50 --srcipmap=172.10.10.5:172.20.20.12

Upvotes: 1

johnklee
johnklee

Reputation: 2270

Should be:

--dstipmap=[ff02::16]:[fe80::20c:29ff:fe4c:84f2]

Upvotes: 3

Related Questions