A capture on disk is evidence. A device under test (DUT) only sees that evidence if you put the packets on a lab interface — with the MAC and IP addresses the DUT expects, at a rate it can take, and without sending anything onto a production network.

This article compares tcpreplay with the built-in senders in PCAP Workbench and Mobile Core Generator, and a safe lab workflow. Replay only on an authorized, isolated network. Prefer loopback or a dedicated test segment.

Why a straight replay often fails

The file was taken somewhere else. On your lab link, several things are usually wrong at once:

  • Layer-2 next hop. The destination MAC is still the original switch or router, not the DUT.
  • Layer-3 addresses. The DUT may be listening on a different IP, or it may drop packets whose source is not on the test subnet.
  • Checksums. After an address rewrite, IPv4, UDP and TCP checksums must be recalculated, or the DUT discards the frame.
  • Link type. Many senders expect Ethernet (link type 1). A raw IP capture, a Linux cooked (any) capture, or a loopback dump has to be converted first.
  • Timing. Original timing may be too slow for a load test, or too fast for a debug session.

Rewrite and validate offline, then send. Never point a replay at a production interface or at a network you do not control.

Option 1: tcprewrite and tcpreplay

This is the classic CLI path. tcprewrite edits the file and never touches a network interface. tcpreplay then sends the result.

Rewrite the next-hop MAC (and, if needed, the source), remap a network, and fix checksums:

tcprewrite --infile=capture.pcap --outfile=lab.pcap --enet-dmac=00:11:22:33:44:55 --pnat=10.0.0.0/8:192.168.50.0/24 --fixcsum
sudo tcpreplay --intf1=eth0 lab.pcap

Speed is one choice: original timing (the default), --multiplier, --pps, --mbps, or --topspeed. --loop repeats the file (0 means until you stop). For a device that sits in the path, tcpprep can classify client and server packets so tcpreplay can send each side out a different NIC.

Good for: scripted lab racks, two-interface in-line tests, and rate-controlled replay.

Limits: tcpreplay needs root (or equivalent) and has no built-in "loopback only" guard. You choose the interface. A raw or cooked capture must be converted first (tcprewrite --dlt=enet with --enet-smac and --enet-dmac). Inner addresses in tunnels are not rewritten by a simple --pnat of the outer header.

Option 2: PCAP Workbench Send to network

PCAP Workbench includes a Send to network tab (also Tools > Send PCAP to network...). According to the product page and User Guide, it:

  • sends a PCAP or PCAPNG with Ethernet link type 1;
  • lists interfaces with loopback first and selected by default, so frames stay on the PC until you say otherwise;
  • requires Allow real network for any other interface (the first tick in a run asks you to confirm); every launch starts with the box unticked;
  • can rewrite Target IP, Target MAC and Source MAC and recompute IPv4, UDP and TCP checksums;
  • offers pacing (*Original timing*, *Speed ×*, *Packets/s*, or *Top speed*), loops (0 repeats until Stop), and live TX counters.

On Windows it uses Npcap; on Linux it uses an AF_PACKET socket (root or CAP_NET_RAW). The CLI never prompts. A real interface needs --allow-remote (alias --allow-real-network); without it the command exits 2 and sends nothing:

LooshaPcapWorkbench --list-interfaces
LooshaPcapWorkbench --send-pcap FILE --iface NAME --dst-ip IP --dst-mac MAC --src-mac MAC --allow-remote

Save edits before sending: the file on disk is what goes out. Send to network is available in Community and Full editions.

Option 3: Mobile Core Generator Send to network

If the capture was generated as a GTPv2-C / PFCP / GTP-U scenario, Mobile Core Generator can replay it the same way: loopback by default, real interfaces only with Allow real network (CLI: -allow-remote), with target IP/MAC rewrite and live TX counters.

gtpcore interfaces
gtpcore replay -pcap out.pcap -iface NAME -dst-ip IP -dst-mac MAC -allow-remote

Community Edition caps send-to-network at 1000 packets/s; Full Edition sends at full speed. Probe and the conformance suite (Full Edition) go further than replay: they wait for replies and report a result. Those belong in a later, DUT-facing test, not in a first "put this pcap on the wire" step.

A safe lab workflow

  1. Isolate. Use loopback, or a dedicated lab adapter with no path to production or the public Internet.
  2. Check the link type. If the file is raw IP or Linux cooked, convert it to Ethernet before a tool that requires link type 1. (The companion article on VLAN and GTP-U conversion covers that step.)
  3. Rewrite addresses offline. Set the destination MAC (and IP, if needed) to the DUT, and fix checksums.
  4. Try loopback first. Confirm the sender runs, the counters move, and a local sniffer sees the frames.
  5. Send a short, finite burst to the DUT. Prefer original timing or a modest packets/s rate until you know the device keeps up.
  6. Stop and inspect. Do not leave a loop running unattended.

Which tool when?

Need Good fit
Scripted rewrite + send, including two NICs tcprewrite + tcpreplay
GUI or CLI send with loopback as the safe default, IP/MAC rewrite PCAP Workbench Send to network
Replay a generated mobile-core scenario, same safety rule Mobile Core Generator replay
Load one packet from a pcap to edit or send Karat Packet Player (not a bulk replayer)

Editions

PCAP Workbench has a Community Edition, free for personal, educational and non-commercial use, with a 10-packet cap on operations that write a new capture. Send to network itself is available in both editions. The Full Edition is a one-time $59 license with no packet-count limit. The current release runs on Windows 10/11 64-bit; a Linux build is available on request. Npcap (Windows) or raw-socket privileges (Linux) are needed to send.

Explore PCAP Workbench →

Limitations

  • Workbench and Mobile Core replay send Ethernet captures (link type 1). Convert other link types first.
  • Target rewrite changes the addresses you give it; it is not a full CIDR map of every inner tunnel header.
  • Community Mobile Core send is capped at 1000 packets/s.
  • You alone are responsible for authorized use. Never replay onto a production network.

FAQ

Will the tools send on a real NIC by accident?
PCAP Workbench and Mobile Core Generator select loopback by default. A real interface needs an explicit allow flag (and, in the GUI, a confirmation the first time). tcpreplay sends on the interface you name; it has no such guard.

Do I have to rewrite checksums by hand?
No, if you use --fixcsum with tcprewrite, or the Target rewrite in Workbench / Mobile Core, which recomputes IPv4 and UDP/TCP checksums.

Can I keep the original inter-packet timing?
Yes. That is the default in tcpreplay and the *Original timing* / -speed 1 pacing in the Loosha Soft senders.

Is live send required to prepare the file?
No. Rewrite and save the pcap first; sending is a separate step.