1
votes

I capture network packets of specific protocol (over UDP if this matters) and I need to repeat them to different destination. Just sending captured packets will lose original source/destination IPs but I need to preserve them.

That new destination is 3rd-party tool so I cannot supply original source/destination IPs in custom format. It's connected directly with my ethernet card, so I'm thinking about using raw sockets.

I have IP packets. Can I send them over raw sockets directly to one of my ethernet cards so device connected to this ethernet card will receive them in exactly original view (at least on IP level)? Any other solution?

P.S. It's intended for completely legal usage if you worry about this, for remote monitoring/recording purposes.

1
just googling around this looks like a good doc, if you've not found it - enderunix.org/docs/en/rawipspoof (section 6)andrew cooke

1 Answers

3
votes

If you have the packets captured in pcap format (tcpdump, wireshark, ...), you can use tcpreplay to replay them.