This is a static archive of our old Q&A Site. Please post any new questions and answers at

How can I play back captured data


I've captured packets going to a WAN router. I want to play them back at ideally a user specifed rate to a new router model so I an monitor the router's performance using our data in our configuration.

I realize I'll have to configure the MAC address of the new router's interface to match the MAC in the captured packets.

asked 13 May '11, 12:50

DonDCajun's gravatar image

accept rate: 0%

4 Answers:


Yes, you indeed need to change the mac-address of the traffic. You would also need to split the traffic into incoming and outgoing traffic, as you would want both to be injected to a different interface (internal and external interface). The the router must not do anything else than routing. Even NAT will break this kind of reproduction...

A tool that you can use to replace the mac-addresses is bittwist

answered 13 May '11, 13:51

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

Thanks for the comment. Several of my captures are one way only so no need to separate.

BUT how do I play back the traffic?????

(13 May '11, 14:04) DonDCajun

You can also do that with bittwist (actually, bittwist will replay the traffic after you first changed the mac-addresses with bittwiste which is also in the suite).

(13 May '11, 14:06) SYN-bit ♦♦


If you only want to replay one TCP/UDP stream, you can use NetworkExpect with your captured data. See also Rewrite And Replay.

answered 18 Sep '12, 13:59

Janus%20Troelsen's gravatar image

Janus Troelsen
accept rate: 0%

edited 18 Sep '12, 14:07


You can play back using TCP Replay. This application exactly replay the captured traffic.

answered 07 Dec '12, 08:03

fates's gravatar image

accept rate: 0%


I use Colasoft Packet Player. I have also used a commandline utility named Preplay (PacketSendingUtility.exe) from Secgeeks.

answered 16 Jun '14, 05:51

alfa's gravatar image

accept rate: 0%