Tcpreplay with suricata

Help
1

Hello there,

Are there any problems with my suricata.yaml settings?
The version of my Suricata is 6.0.3.

I could read pcap file with the following command and signature alerts drop into eve.json.

suricata -c /etc/suricata/suricata.yaml -r somePcap.pcap

I tried to replay the same pcap with tcpreplay with:
tcpreplay -i eth0 somePcap.pcap

But in this case, there is no alerts in eve.json and all.

I tired to fix the checksum withTcprewrite and replayed the pcap again, but it still didn’t work.

2

Hí,
I usually use tcpreplay-edit. For example:

sudo tcpreplay-edit -i eno1 -v --pps=50 --pnat=10.5.3.0/24:192.168.1.0/24 somePcap.pcap

3

Thank you, i fixed the MTU to a larger volume and it works.

1 Like