1

When I use 'tcpreplay' to send packets to my switch, I found that packets are out of order. For example, using tcpreplay -i eth1 test.pcap, I get:

I send packets like **[1,2,3,4,5，……]**， but switch received **[1,3,4,2,5,……]**.

Does this problem look familiar? How did you solve it?

Ross Jacobs
  • 2,962
  • 1
  • 17
  • 27
WuDangWangYe
  • 23
  • 5
  • 1
    Networks sometimes reorder packets, this is something higher-level protocols deal with. – Barmar Jan 16 '20 at 18:29
  • I have a pcap file on my server with about 100,000 data packets. I just want to use tcpreplay to send packets out of the server network port in order. – WuDangWangYe Jan 17 '20 at 01:41

1 Answers1

0

When you say switch received a different packet order- how are you determining this is the case? I ask because if you are sniffing on the switch port that would seem like a valid way to check for this, but if you're using a SPAN port then yeah, switches can re-order frames in my experience so I'm not that surprised.

When you run tcpdump on the tcpreplay box, which order does it show the packets being sent? Also, is there another switch in between? Because a lot of switches use a "store and forward" approach which can reorder frames (this is also why SPAN ports tend to re-order).

Lastly, tcpreplay always sends packets in order to the kernel/NIC driver/NIC because it processes the pcap file sequentially. If your computer is actually sending frames out of order, then that is happening either in the kernel, NIC driver or NIC hardware/firmware.

Aaron Turner
  • 319
  • 1
  • 3
  • well，i replayed pcpa to tap, as i know, it will directly forward traffic, i send pcap from eth1 to swicth and capture pcap from eth2, when i open pcapfile in wireshark, i find it re-order. so far, i just find little info with "reorder when tcpreplay", i have no exact idea of it. – WuDangWangYe Mar 29 '20 at 09:37
  • 1
    So there are two places packet ordering can get changed: 1. NIC / NIC Driver. There's nothing that says packets written to eth1 have to be sent in the order they were sent. 2. The switch re-ordered the frames. Switches due to their store-and-forward architectures explicitly do not guarantee order of packets In/Out. – Aaron Turner Mar 30 '20 at 16:07