Posted: 08/12/2023
Replaying Network Captures
When building any network related software, sometimes you need to capture the network traffic to debug an issue. The tool of choice tends to be Wireshark, which is truly excellent and I have used it for many years debugging TELNET, HTTP, SIP, UDP & RTP traffic.
However when you have a network capture, and determined the solution to your problem, you now need want to prove the problem is solved, and the best way to do that is to generate the network traffic again. However what if the system outputting the traffic is a closed system miles away. The best way then is to replay the network capture.
Wireshark its self does not support replaying the captures, but there are other tools out there. One of which is a piece of software called Colasoft Packet Player which you can get from here:
https://www.colasoft.com/packet_player/
It is a very simple tool:
Once started, you select which network adapter to send the traffic over andthe network capture file to replay.
Then Click 'Play' and the packets will then be sent over your chosen network card!
NOTE: The packets are sent in real time which means that if you have a 12 hour capture, it will take 12 hours to send all the packets out. There are play speed options to adjust this if your software will cope with that.
Thanks for reading this post.
If you want to reach out, catch me on Twitter!
I am always open to mentoring people, so get in touch.