Pcap Player

Pcap Player is a tool designed to replay data from a pcap file as live traffic to a chosen adapter.
It allows both sending the traffic from the pcap file as fast as possible or respecting the same timing of the original file.
Pcap Player also allows for filtering packets based on hardware properties found in packets (for example IP address) and gateway port number.

User Interface

Pcap Player user interface contains the following items:

Parameters sets the parameters of the pcap file to be played (explained in Parameters section).
WinPcap sets the parameters of the hardware filter and gateway range (explained in Filter section).
Transformations
- Auto Depacketize TECMP: determines whether or not to automatically split TECMP packetized frames into separate frames. This option, if not introduced in other components, means that TECMP frames are automatically depacketized.
- Drop Gateway Header: determines whether or not to drop the gateway header while sending the packets. For example, if the packet has a BRSpy header, this header will be dropped if this element is checked.
Packet sending determines if the packets of the pcap file will be played as fast as possible or while respecting the original timestamp of the file.
Start starts playing the pcap file over the selected adapter after setting the configuration.

Warning

Send as fast as possible may lead to packet loss for the receiver. For further information, see Packet loss detected.

Note

Pcap Player has a status bar at the bottom of it that shows if pcap file is still sending or not as displayed in the picture below. When sending is started or stopped the Stop button changes accordingly.

Example Use Case

At first, the file path and adapter need to be chosen.
If needed a filter can be set as will be explained in Filter section.
Sending mode is chosen (as fast as possible or respecting timestap).
Start sending by clicking Start button.
Status bar will show the progress of the operation.

Parameters

Before playing a pcap file, the parameters need to be set:

Pcap file gets chosen from the file chooser dialog.
Adapter selected from the adapters drop down menu.
Buffer value is chosen, this is the value for the hardware buffer that will be used while sending the packets (packets queue buffer).

Filter

This enables filtering packets before playing them via the adapter.

Packets Filter

The filter has three parts:

Capture Filter

WinPcap Capture Filter configuration allows you to specify a complex filter criteria. It allows you to filter frames you are interested in and discard uninteresting ones.

Important

Filter syntax is accessible in PCAP_Filter.

Vlan Support

You can specify if you need packets with vlan or not by choosing TRUE or FALSE in Vlan Support field.

Gateway Port Filter

Gateway Port Filter allows the specification of port ranges that are usable while filtering packets.
When filtering a packet, if the gateway port value does not match the filtered ports it will be discarded.

Important

Gateway Port Filter syntax is as follows:

Port Filter items separated by commas. Example 1, 2
Items could be single port numbers or ranges (range is two numbers separated by dash). Example 1, 2, 5-9
Port filtering supports reception ports (Rx) and transmission ports (Tx)
Values could be either decimal or hexadecimal. Example 1, 0x05, 5-0x09
Spaces are allowed between an item and a comma, or an item and a dash, For example 1, 2, 4 - 5 is correct but 1,4 5 is wrong

Note

When working with gateways (BRSpy or Capture Module for example), if present, the filter will handle the encapsulated Ethernet packet and not the Raw packet.

Note

The supported gateways and their ether types are:

BR-SPY ETH Wrapper (0x2082)
BR-SPY ETH Mini Wrapper (0x2182)
BR-SPY ETH Mini Wrapper Legacy (0x2183)
BR-SPY ETH 1000T Mini Wrapper (0x2282)
BR-SPY CAN Wrapper (0x2085)

Only the packets that match the chosen filter are sent.