Skip to content

PCAP Edit and Replay

Available since version 0.4

Although Ostinato is primarily designed to create packets from scratch, you can also import an existing PCAP file, edit (optional) and replay it.

To import a PCAP file, first select the appropriate port in the ports list and then goto File | Open Streams (alternatively use the right-click context menu).

In the Open streams file dialog, change the file filter to PCAP (*.pcap) or All files (*) and then open your PCAP file.

This will open a Pcap import options dialog -

Pcap Import Options

Intelligent Import (via PDML)

If this option is checked, Ostinato will attempt to use tshark (the command-line version of Wireshark) to decode the packets in the pcap file and then use the decoded information to create Ostinato streams. By doing so, you will be able to use Ostinato's extensive packet crafting features to edit individual protocols and fields before replay.

If this option is not checked, Ostinato will not attempt to decode the packets but will just import them as raw binary/hexdump. Editing the packet before replay can still be performed - but it will be at the hexdump level.

Do a diff after import

If this option is checked, after an intelligent import, Ostinato will generate the raw binary/hexdump from the imported information and compare that to the original raw/binary packet hexdump in the PCAP file - this ensures that the import has been performed correctly.

Please see this FAQ entry for a list of possible reasons why the import may not be correct or show a diff.

Apart from PCAP files, Ostinato can also import PDML files. Import of PcapNg files is supported Ostinato version 1.1 onwards. For older versions, you can convert the PcapNg file to PCAP file using Wireshark before importing into Ostinato.

Replay timing

After import, unless you change any stream rates, Ostinato on transmit will replay the packets with similar timing as in the original PCAP file.

Back to top