Skip to content

tcpreplay-edit incorrectly rewrites layer 3 length field to include Ethernet padding #845

@iczero

Description

@iczero

Describe the bug
Ethernet has a 64-byte minimum frame size. Frames smaller than this (for example, plain TCP ACK without options on IPv4) need to be padded to 64 bytes (60 bytes excluding FCS). tcpreplay-edit (but not tcpreplay) will incorrectly include Ethernet padding bytes in the IP length field.

To Reproduce
Steps to reproduce the behavior:

  1. Start tcpdump on the interface where tcpreplay-edit will be run
  2. tcpreplay-edit any pcap with ethernet padding bytes to the interface
  3. Observe that the replayed packets have the IP length field modified to include padding bytes (Wireshark should complain a lot)

Expected behavior
tcpreplay-edit (like tcpreplay) does not modify the IP length field and keeps the padding.

System (please complete the following information):

  • OS: Fedora 39 (Linux 6.6.9-200.fc39.x86_64)
  • Tcpreplay Version: latest master, currently 43693c4

Additional context
None

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions