Hi: Can wireshark playback a captured tcpip session between a client and a server? For the playback can the ip addresses be changed, for example the client and server are moved to a different subnet. Can the capture and playback use a mac address instead of an ip address? Thank you! asked 30 Jan '13, 09:17  rkidd |
2 Answers:
Wireshark does not contain playback functionality. answered 30 Jan '13, 09:21  SYN-bit ♦♦ |
you may want to take a look at tcpreplay tool. answered 30 Jan '13, 10:19  Aruna Sirigere Is there a good replay for the MAC for wireshark captures? Thanks! (01 Feb '13, 06:01) rkidd If by "the MAC" you mean "Macintoshes", then, yes, there's a program that can read pcap captures, and pcap-ng captures on Snow Leopard and later, and replay them. It's called tcpreplay. (01 Feb '13, 15:29) Guy Harris ♦♦ |
Thank you for the quick response! Can wireshark capture a session to a file that can be played back by another tool?
(I converted your "answer" to a "comment", please see the FAQ for more info on how to best use this site)
Yes, you can capture data and save it in pcap format. This used to be the default format until version 1.8.x. Now pcap-ng is the default format (because of its extended features), but captures can still be saved in pcap format so they can be used in other applications.