{"action":"opened","issue":{"url":"https://api.github.com/repos/appneta/tcpreplay/issues/201","labels_url":"https://api.github.com/repos/appneta/tcpreplay/issues/201/labels{/name}","comments_url":"https://api.github.com/repos/appneta/tcpreplay/issues/201/comments","events_url":"https://api.github.com/repos/appneta/tcpreplay/issues/201/events","html_url":"https://github.com/appneta/tcpreplay/issues/201","id":108677253,"number":201,"title":"Tcpreplay needs a \"live\" interface?","user":{"login":"b-u-g-s","id":8517705,"avatar_url":"https://avatars.githubusercontent.com/u/8517705?v=3","gravatar_id":"","url":"https://api.github.com/users/b-u-g-s","html_url":"https://github.com/b-u-g-s","followers_url":"https://api.github.com/users/b-u-g-s/followers","following_url":"https://api.github.com/users/b-u-g-s/following{/other_user}","gists_url":"https://api.github.com/users/b-u-g-s/gists{/gist_id}","starred_url":"https://api.github.com/users/b-u-g-s/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/b-u-g-s/subscriptions","organizations_url":"https://api.github.com/users/b-u-g-s/orgs","repos_url":"https://api.github.com/users/b-u-g-s/repos","events_url":"https://api.github.com/users/b-u-g-s/events{/privacy}","received_events_url":"https://api.github.com/users/b-u-g-s/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-09-28T15:06:57Z","updated_at":"2015-09-28T15:06:57Z","closed_at":null,"body":"Hi, \r\n\r\nI am wondering if anyone could help me with a problem with tcpreplay, I am not sure if it is a bug or if I am doing something wrong/it is by design... \r\nI have a pcap from a computer/network. \r\nI want to use that pcap on my IDS (on a completely different network/environment). On this computer I have 2 NIC: 1) eth0 a live primary interface with an IP assigned and 2) eth1 a monitoring interface in promisc mode, no IP.\r\n\r\n- if I do tcpreplay -t -i eth0 my.pcap\r\nI can see the traffic being replayed (just using etherape to have a visual cue and also can see alerts in my IDS)\r\n\r\n- if I do tcpreplay -t -i eth1 my.pcap\r\nthen nothing seems to be replayed... although tcpreplay tells me it has replayed the traffic\r\n\r\nnow... if I plug a cable into my eth1 interface ... and do tcpreplay -t -i eth1 my.pcap then it works!\r\nbut the idea, is that I want to replay in offline mode...\r\n\r\nany ideas why this happens?\r\nlooks like tcpreplay can only replay on an interface which is \"live\" with \"real\" traffic going through it.\r\nI have tried with tcpreplay version 3.4.4 and 4.1.0 on Debian Jessie 8 (SELKS distro) in a VMware virtual machine. eth0 is my wifi and eth1 is the ethernet built-in adaptor.\r\nI have also tried to play with different speed (-x).\r\n\r\nOne thing to note, is if I try to get a bit more info and enable verbose mode (-v) I get an error:\r\nFatal Error:\r\npoll() timeout... tcpdump seems to be having a problem keeping up\r\nTry increasing TCPDUMP_POLL_TIMEOUT\r\n\r\nBut really... why can etherape/my IDS can see tcpreplay traffic on an interface in promiscuous mode with no IP assigned only when there is a network cable and some other traffic going through it? it looks as if tcpreplay is ignored...\r\nI also tried with a static IP address, still no luck. I need to have a cable plugged in.\r\n\r\nThanks,\r\nBugs."}}