tcprewrite - tcprewrite does not alter output file udp multicast

[michalcomprimagic]

Describe the bug
tcprewrite does not alter port, srcip, dstip ect... in the pcap https://we.tl/t-hgcIa2dGMj

./tcprewrite --srcipmap=10.96.225.227:172.31.22.85 --infile=/home/ec2-user/inputpcap.pcapng --outfile=inputready.pcap

Nothing is changed in output file. Aim is to change the source IP address for all packets

To Reproduce

1. Install tcpreplay, from tarball, ./configure, make, make install
2. Use following pcap: https://we.tl/t-hgcIa2dGMj
3. libpcap up to date

System:
Attempted both with Centos 07, and AWS Linux 2 AMI

[ChuckCottrill]

I have observed that pcap packets with IPv6 fragmentation do not rewrite (#831)
Is this for all packets, or only certain packets?
Do you have a minimal reproducible pcap that demonstrates the problem?

[michalcomprimagic]

Hi Chuck, thanks for the fast response.

Yes this is for all packets. You can use the pcap in the link. However the --v flag shows no issue, just prints the pcap packet descriptions without any changes.

Maybe there is an issue with my installation method.... Is there anything I can do to troubleshoot this?

[ChuckCottrill]

Hey Michal,
I had a similar problem with IPv6 packets with fragment headers (#831),
so this behavior may be caused by a similar issue.
The pcap file you provide is large. Please extract and upload a couple of packets (tcpdump, wireshark/tshark, editcap) here?
https://stackoverflow.com/questions/19633225/how-do-i-get-a-specific-range-of-packets-from-a-large-pcap-file-with-tcpdump

[ChuckCottrill]

Since PR #832 was merged, please check that branch to see whether the change fixes your problem.

[michalcomprimagic]

I found the problem. The pcap I was inputting hadn't been decoded as RTP. Once it was decoded the search masks for source and destination were met. However then the DLT could not be found. I guess when you decode as RTP in wireshark it looses the DLT. I'm not sure how to manipulate a RTP pcap so that it is compatible with tcprewrite.

…

On Thu, Jan 11, 2024 at 6:37 PM Chuck ***@***.***> wrote: Since PR #832 <#832> was merged, please check that branch to see whether the change fixes your problem. — Reply to this email directly, view it on GitHub <#833 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BERUEEXRB6XIPALMAXVFEOTYOAPORAVCNFSM6AAAAABAM3EUL6VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQOBXGY2TGNBWGU> . You are receiving this because you authored the thread.Message ID: ***@***.***>

-- [image: Logo] <https://www.comprimato.com/> Michael Lawton | Broadcast Engineer a: Comprimato Systems Ltd. e: ***@***.*** ***@***.***>*

[ChuckCottrill]

If you have found the problem and it wasn't with tcpreplay, please close the ticket.