[Tcpreplay-users] tcpreplay traffic into squid for logging

[Oguz Y. <ogu...@gm...>]

Dear list members,

I am planning to use tcpdump+tcprewrite+tcpreplay to get outgoing http
traffic from br0 bridge interface, rewrite it to someinterfaceip:8080
destination and tcpreplay it on someinterface interface.

Look:
tcpdump -i br0 vlan and dst port 80 -s0 -w - -U  |  tcprewrite
--portmap=80:8080 --dstipmap=0.0.0.0/0:10.0.0.1 --enet-vlan=del
--fixcsum --infile=- --outfile=- | tcpreplay --quiet --intf1=eth0 -

on eth0 interface I have 10.0.0.1 as IP address and squid listening on 0.0.0.0.

I run the command. tcpdump on eth0 shows tcpreplay works however, none
of the packets are not seen by squid.

21:05:24.308396 IP 78.185.46.53.49459 > 10.0.0.1.8080: . ack 5809 win 4356
21:05:24.313396 IP 212.253.11.112.1195 > 10.0.0.1.8080: . ack 3457 win 65535

I suspect some kernel internals, and hooks are before tcpreplay puts
the packet on the ethernet.

What do you propose to me for the aim?

Besr Regards,

Oğuz YILMAZ