PCAP Edit and Replay
Available since version 0.4
Although Ostinato is primarily designed to create packets from scratch, you can also import an existing PCAP file, edit (optional) and replay it.
To import a PCAP file, first select the appropriate port in the ports list and then goto
File | Open Streams (alternatively use the right-click context menu).
In the Open streams file dialog, change the file filter to
PCAP (*.pcap) or
All files (*) and then open your PCAP file.
This will open a Pcap import options dialog -
Intelligent Import (via PDML)
If this option is checked, Ostinato will attempt to use tshark (the command-line version of Wireshark) to decode the packets in the pcap file and then use the decoded information to create Ostinato streams. By doing so, you will be able to use Ostinato's extensive packet crafting features to edit individual protocols and fields before replay.
If this open is not checked, Ostinato will not attempt to decode the packets but will just import them as raw binary/hexdump. Editing the packet before replay can still be performed - but it will be at the hexdump level.
The intelligent import option is dependent on the tshark version - for best results it is recommended that you always run the latest 1.x tshark/Wireshark version (2.x versions don't work well yet). You can have both 1.x and 2.x versions installed parallely and change Ostinato preferences to use the 1.x version
Do a diff after import
If this option is checked, after an intelligent import, Ostinato will generate the raw binary/hexdump from the imported information and compare that to the original raw/binary packet hexdump in the PCAP file - this ensures that the import has been performed correctly.
Please see this FAQ entry for a list of possible reasons why the import may not be correct or show a diff.
Apart from PCAP files, Ostinato can also import PDML files. Import of PcapNg files is currently not supported - you can convert the PcapNg file to PCAP file using Wireshark before importing into Ostinato.