-
Notifications
You must be signed in to change notification settings - Fork 290
Description
tcprewrite --enet-vlan=del -S 10.0.0.0/8:10.11.29.0/24 -D 239.126.24.0/24:239.254.24.0/24,239.192.136.0/24:239.64.136.0/24 -i ./trace.pcap -o ./trace-novlanid-changesrc-changedst.pcap
When changing the destination IP address of multicast group addresses, tcprewrite doesnt currently recalculate the destination mac address.
With careful choice of the new destination multicast IP address, I can use a group address which maps onto the same mac address which exists in the capture.
A feature which is able to recalculate the correct corresponding destination mac address for the multicast group would make this far more flexible, and allow any destination IP multicast group to be used without causing havoc to the network.
It is important when switching multicast traffic that the correct corresponding mac address is used in the packet header, as network switches snoop this data and make pseudo entries in their mac address tables for these addresses to avoid flooding packets to all switch ports.
I realise tcprewrite can make changes to mac addresses currently, but this is a laboious task if a range of destination multicast addresses are to be changed
A tcprewrite switch to perform a 'Force recalculation of multicast mac address' similar to the --fixcsum funtion would suffice I believe.
The transpostion of multicast IP addreeses to mac address is well detailed, an example of which is here.
http://www.dqnetworks.ie/toolsinfo.d/multicastaddressing.html
Im my scenario, I have captures of multicast video traffic which I wish to replay.
However, I am unable to replay them using the same destination multicast addresses as they will clash with live traffic - so it is nessessary to chnage the destination multicast group addresses.
This currently works using the example above, but unless I chose the correct corresponding multicast group which matches the mac address already in the captures, the traffic is flooded to the network (as the network switches snoop the packets, and make the wrong pseudo mac address tabel entries).