Continue despite failed packet when using tcpreplay

Question

I am trying to use tcpreplay to send the contents of a pcap file. It is refusing to send some packets because they are too long. However, instead of continuing with the next packet, it stops:

 $ tcpreplay -i p4p1 multi.pcap
Warning: May need to run as root to get access to all network interfaces.
Warning: Unable to send packet: Error with PF_PACKET send() [444]: Message too long (errno = 90)
Actual: 443 packets (63852 bytes) sent in 0.203486 seconds
Rated: 313790.6 Bps, 2.51 Mbps, 2177.05 pps
Flows: 115 flows, 565.14 fps, 405 flow packets, 39 non-flow
Statistics for network device: p4p1
        Successful packets:        443
        Failed packets:            1
        Truncated packets:         0
        Retried packets (ENOBUFS): 0
        Retried packets (EAGAIN):  0

I would like to skip failed packets and send the rest.

Can you post a link to multi.pcap – Ross Jacobs Dec 03 '20 at 23:27 — Ross Jacobs, Dec 03 '20 at 23:27

Leandro Pereira · Answer 1 · 2022-08-09T22:49:39.087

I was having the same problem with several files, especially with streaming. Example:

~# tcpreplay -i eth1 -t -K facebook_audio2b.pcapng
File Cache is enabled
Warning: Unable to send packet: Error with PF_PACKET send() [1611]: Message
too long (errno = 90)
Actual: 1610 packets (382007 bytes) sent in 0.021233 seconds
Rated: 17991192.9 Bps, 143.92 Mbps, 75825.36 pps
Flows: 71 flows, 3343.85 fps, 94008 flow packets, 84 non-flow
Statistics for network device: eth1
        Successful packets:        1610
        Failed packets:            1
        Truncated packets:         0
        Retried packets (ENOBUFS): 0
        Retried packets (EAGAIN):  0

I So I followed the FAQ on the Tcpreplay website at the [link].(https://tcpreplay.appneta.com/wiki/faq.html#packet-length-8892-is-greater-then-mtu-skipping-packet) that says:

In case the packet is larger than the MTU, a alternatively, you can specify the tcpreplay-edit --mtu-trunc option - packets will be truncated to the MTU size, the checksums will be fixed and then sent. Note that this may impact performance.

It works for me in the next run:

~# tcpreplay-edit --mtu-trunc -i eth1 -t -K facebook_audio2b.pcapng
File Cache is enabled
Actual: 94092 packets (14586277 bytes) sent in 0.847842 seconds
Rated: 17204003.8 Bps, 137.63 Mbps, 110978.22 pps
Flows: 71 flows, 83.74 fps, 94008 flow packets, 84 non-flow
Statistics for network device: eth1
        Successful packets:        94092
        Failed packets:            0
        Truncated packets:         0
        Retried packets (ENOBUFS): 0
        Retried packets (EAGAIN):  0

score 0 · Answer 2 · answered Jul 29 '21 at 07:09

The reason you receive "Message too long" is because the MTU on your network interface is smaller than your packet size.

You can increase the MTU size of your system and than all packets on the pcap will be sent.

In Linux from user root you can use the command: ifconfig {interface} mtu {New Size}

Continue despite failed packet when using tcpreplay

2 Answers2