PCAP Edit and Replay

Available since version 0.4

Although Ostinato is primarily designed to create packets from scratch, you can also import an existing PCAP file, edit (optional) and replay it.

To import a PCAP file, first select the appropriate port in the ports list and then goto Streams | Open Streams (alternatively use the right-click context menu).

Prior to v1.2.0, stream related menu items were under the File menu

In the Open streams file dialog, change the file filter to PCAP (*.pcap) or All files (*) and then open your PCAP file.

This will open a Pcap import options dialog -

Intelligent Import (via PDML)

If this option is checked, Ostinato will attempt to use tshark (the command-line version of Wireshark) to decode the packets in the pcap file and then use the decoded information to create Ostinato streams. By doing so, you will be able to use Ostinato's extensive packet crafting features to edit individual protocols and fields before replay.

If this option is not checked, Ostinato will not attempt to decode the packets but will just import them as raw binary/hexdump. Editing the packet before replay can still be performed - but it will be at the hexdump level.

Importing nanosecond PCAPs in raw mode

Before v1.2, a PCAP file with nanosecond timestamps when imported in raw mode will lose the nanosecond precision and use microseconds instead

Recalculate Checksums

If this option is checked, Ostinato will re-calculate protocol checksums. This is required, if you plan to edit protocol fields after import. If your PCAP contains packets with incorrect checksum values and you want to retain those values for replay, uncheck this option.

Do a diff after import

If this option is checked, after an intelligent import, Ostinato will generate the raw binary/hexdump from the imported information and compare that to the original raw/binary packet hexdump in the PCAP file - this ensures that the import has been performed correctly.

Please see this FAQ entry for a list of possible reasons why the import may not be correct or show a diff.

Other capture file types

Apart from PCAP files, Ostinato can also import PDML files. Import of PcapNg files is supported Ostinato version 1.1 onwards. For older versions, you can convert the PcapNg file to PCAP file using Wireshark before importing into Ostinato.

PCAP editing

Each packet in the PCAP is imported as a stream. You can edit each stream to change protocol fields. For bulk editing multiple streams at once, see Find & Replace.

Replay timing

After import, unless you change any stream rates, Ostinato on transmit will replay the packets with similar timing as in the original PCAP file.