Abstract
Network packet analysis and replay techniques are basic tools for security assessment, intrusion detection system (IDS) validation, and teaching. This article covers the theory and the practice of using Wireshark for packet capture in conjunction with packet replay utilities such as Tcpreplay to simulate network attacks in controlled environments. By capturing valid packets and sending them again, practitioners and students can show which protocols lack replay protection and check whether their defenses notice. The approach follows NIST Special Publication 800-115 on security testing. It covers the PCAP file format, protocols vulnerable to replay, setting up Wireshark for capture, the Tcpreplay suite, validating IDS/IPS products, and the ethics of testing.
Keywords: Wireshark, packet capture, Tcpreplay, intrusion detection, network security, penetration testing, PCAP, attack simulation, replay attacks
1. Introduction
You cannot find and stop network attacks without understanding what happens at the packet level, and with so many network-based threats around, regular security testing is part of any serious security program. According to the National Institute of Standards and Technology (NIST), security testing is mandated under the Federal Information Security Management Act (FISMA) and other regulations, requiring periodic testing and evaluation of security policies, procedures, and practices (Scarfone, Souppaya, Cody, & Orebaugh, 2008).
Wireshark, developed by Gerald Combs and the Wireshark Foundation, is the standard tool for network protocol analysis (Wireshark Foundation, n.d.). Described as “the world’s most popular network protocol analyzer,” the software inspects hundreds of protocols and can capture live traffic from a network interface or analyze a saved capture. As noted in the official documentation, Wireshark “will not manipulate things on the network” but is a measurement and analysis tool (Wireshark User’s Guide, 2025).
You need to be able to simulate an attack without touching a live production network. Packet replay attacks, a fundamental concept in cryptography and network security, involve intercepting valid data and later resending it to elicit a malicious response (Kaufman, Perlman, & Speciner, 2011). This article describes how to use Wireshark together with packet replay tools to simulate network attacks, from the theory through a practical setup, and ties it to established security testing frameworks.
2. Theoretical Framework
2.1 Network Packet Capture and the PCAP Format
The packet capture (PCAP) file format is the standard way to store network traffic captures. According to the IETF Operations and Management Area Working Group draft specification, the format “describes the format used by the libpcap library to record captured packets to a file” and has its origins in the late 1980s when Van Jacobson, Steve McCanne, and colleagues at Lawrence Berkeley National Laboratory developed the tcpdump program (IETF, 2025).
The PCAP format stores packet data with timestamp information, so the original timing of the traffic can be reproduced. As documented by Endace (2025), “a PCAP file includes an exact copy of every byte of every packet as seen on the network, including OSI layers 2-7.” Because nothing is dropped, you can analyze the protocols in detail and replay the traffic accurately.
The libpcap library, maintained by the tcpdump.org project, does the actual capturing. According to the official documentation, the library enables applications to “capture network traffic and analyze it, or to read a saved capture and analyze it” (tcpdump.org, 2025). Windows implementations include Npcap, which uses the NDIS 6.x APIs and so works on current Windows.
2.2 NIST Security Testing Framework
NIST Special Publication 800-115, “Technical Guide to Information Security Testing and Assessment,” is the framework for conducting security assessments. The document defines three assessment methods: testing, examination, and interviewing. It describes testing as “the process of exercising one or more assessment objects under specified conditions to compare actual and expected behaviors” (Scarfone et al., 2008, p. 2-1).
The publication identifies network sniffing as a passive examination technique that “monitors network communication, decodes protocols, and examines headers and payloads to flag information of interest” (Scarfone et al., 2008, p. 3-4). Documented use cases include:
- Capturing and replaying network traffic
- Performing passive network discovery
- Identifying operating systems, applications, services, and protocols
- Identifying unauthorized activities
- Collecting information such as unencrypted credentials
The four-phase penetration testing methodology outlined in NIST SP 800-115 has four phases: planning, discovery, attack, and reporting. Capture and replay matter most in discovery and attack, where they help you find vulnerabilities and confirm them.
3. Packet Capture and Export Mechanics
Replay simulation starts with capturing traffic and exporting it for later analysis or injection. Wireshark grabs raw packets as they cross the network interface and shows them in a readable format.
To simulate an attack, an analyst first finds the packet sequence for a valid action, such as a TCP three-way handshake or an authentication request. Wireshark allows the user to save this traffic to a file in PCAP format, which many other analysis tools can read (Chappell, 2017).
The simulation usually takes three steps:
- Capture: Identifying and saving the specific payload to a file
- Export: Using the saved file or exporting specific packets from Wireshark
- Replay: Injecting the saved packets into a network using tools such as Tcpreplay, Scapy, or tcpdump
4. Wireshark Configuration for Packet Capture
4.1 Interface Selection and Promiscuous Mode
Capturing packets properly depends on how the network interface is set up. According to the libpcap documentation, “on broadcast LANs such as Ethernet, if the network isn’t switched, or if the adapter is connected to a ‘mirror port’ on a switch to which all packets passing through the switch are sent, it will be possible to capture all packets” (tcpdump.org, 2025).
Promiscuous mode lets the network card (NIC) capture all packets on the segment instead of only those addressed to the local machine. This mode “allows it to view all packets on the network segment, not just those addressed to your system” (GeeksforGeeks, 2020).
4.2 Capture and Display Filters
Wireshark has two kinds of filter:
Capture Filters: Based on Berkeley Packet Filter (BPF) syntax, these restrict which packets are recorded during the capture process. The Wireshark User’s Guide (2025) documents that capture filters “filter packets, reducing the amount of data to be captured.”
Common capture filter syntax includes: – Host-based filtering: host 192.168.1.10 – Network-based filtering: net 192.168.1.0/24 – Port-based filtering: port 80
Display Filters: These enable post-capture analysis by narrowing the packets displayed for examination. Display filters are more powerful and understand protocol fields, for example tcp.port == 80 or http.request.uri pattern matching.
5. Protocols Vulnerable to Replay Attacks
Not every protocol is open to replay, and not every replay gets anywhere. Still, Wireshark is often used to simulate attacks on protocols that check neither timestamps nor sequence numbers.
5.1 ARP Spoofing (Address Resolution Protocol)
ARP protocols are stateless and lack mutual authentication. An attacker can capture an ARP reply from a valid gateway and replay it to a victim. The victim, believing it is communicating with the legitimate gateway, will forward traffic to the attacker. In a classroom simulation this shows why ARP caching and static ARP tables matter.
5.2 TCP Handshake Replay
A TCP connection relies on a “SYN,” “SYN-ACK,” and “ACK” sequence. While modern operating systems enforce Sequence Number validation to prevent replay, a replay attack can be simulated if the packets are stripped of headers and resent in a controlled environment. This shows why the TCP sequence number matters as an anti-replay mechanism (Stevens, 1994).
5.3 HTTP Authentication
Simple HTTP Basic Authentication is susceptible to replay if the authentication header is intercepted. Wireshark can be used to capture a request containing valid credentials. While a client usually requires a new handshake for subsequent requests, the simulation shows how badly “stateless” authentication holds up against interception at the network layer (Fielding & Reschke, 2014).
6. The Tcpreplay Suite for Traffic Replay
6.1 Overview and Capabilities
Tcpreplay is “a suite of GPLv3 licensed utilities for UNIX (and Win32 under Cygwin) operating systems for editing and replaying network traffic which was previously captured by tools like tcpdump and Wireshark” (AppNeta, 2025). The suite “allows you to classify traffic as client or server, rewrite Layer 2, 3 and 4 packets and finally replay the traffic back onto the network and through other devices such as switches, routers, firewalls, NIDS and IPS’s.”
The suite includes these utilities:
| Utility | Purpose |
|---|---|
| tcpreplay | Packet injection |
| tcprewrite | Packet modification |
| tcpprep | Traffic classification |
| tcpliveplay | TCP session replay |
| tcpbridge | Bridging functionality |
According to Kali Linux documentation, tcpreplay is “aimed at testing the performance of a NIDS by replaying real background network traffic in which to hide attacks” (Kali Linux Tools, 2025).
6.2 Use Cases for Security Testing
TechTarget identifies several primary use cases for tcpreplay in security contexts:
- Test intrusion detection systems (IDSes) by resending malicious packets hidden in real traffic
- Understand standard attack vectors by resending mock malicious packets
- Test specific network exploits
- Resend test transmissions to check whether router packet filters catch them
- Transmit packets representing normal network traffic to confirm firewall settings
The tcpliveplay component, developed with Cisco sponsorship, enables replay of “TCP pcap files directly to servers” to “test the entire network stack and into the application” (AppNeta, 2025).
6.3 Basic Operation and Syntax
Basic tcpreplay operation requires specification of the output interface and source PCAP file:
# Replay traffic at original captured rate
tcpreplay -i eth0 capture.pcap
# Replay at maximum speed
tcpreplay -t -i eth0 capture.pcap
# Replay at specific bandwidth
tcpreplay --mbps=100 -i eth0 capture.pcap
# Replay at specific packets-per-second
tcpreplay --pps=1000 -i eth0 capture.pcapPacket modification via tcprewrite enables adjustment of source and destination addresses:
# Rewrite destination IP addresses
tcprewrite --dstipmap=192.168.1.1:10.0.0.1 --infile=input.pcap --outfile=output.pcap
# Modify Ethernet layer addresses
tcprewrite --enet-dmac=00:11:22:33:44:55 --infile=input.pcap --outfile=output.pcap7. Intrusion Detection System Validation
7.1 Snort and Suricata Configuration
Snort is “a powerful open-source intrusion detection system (IDS) and intrusion prevention system (IPS) that provides real-time network traffic analysis and data packet logging” using “a rule-based language that combines anomaly, protocol, and signature inspection methods to detect potentially malicious activity” (Fortinet, 2025).
Suricata, developed by the Open Information Security Foundation (OISF), provides multi-threaded processing capabilities. Suricata “utilizes a multi-threaded architecture, allowing it to handle high-traffic environments more efficiently than Snort’s single-threaded approach” and performs “deep packet inspection” as “one of its core functionalities for network threat detection and intrusion prevention” (Stamus Networks, 2025).
7.2 Testing Methodology
Academic research by Day, Flores, and Matthews (2013) established methodology for IDS comparative analysis using packet replay techniques. Their study employed “replaying packets from the iCTF 2010 capture at the rate which they were originally captured at” with packets “rewritten to make use of the 10.10.1.0/24 network configuration” for testing both Snort and Suricata.
The Dalton system, developed by Secureworks, provides “a system that allows a user to quickly and easily run network packet captures (‘pcaps’) against an intrusion detection system (‘IDS’) sensor of his choice (e.g. Snort, Suricata) using defined rulesets and/or bespoke rules” (Secureworks, 2025).
8. Practical Implementation Methodology
8.1 Environment Preparation
Run attack simulations in an isolated test environment. NIST SP 800-115 recommends that “organizations should consider whether testing should be performed on production systems or similarly configured non-production systems, if such alternate systems are available” (Scarfone et al., 2008, p. 6-3).
Things to weigh: – Potential impact to production systems – Presence of sensitive personally identifiable information – Configuration parity between test and production environments
Network segmentation through VLANs or dedicated hardware prevents unintended traffic propagation. Tcpreplay documentation cautions that “replaying traffic, especially at high speeds, can potentially disrupt other applications or devices on the network being tested” so the test network needs to be isolated.
8.2 Capture Acquisition
Traffic captures may be obtained through several sources:
- Wireshark Wiki Sample Captures: Including documented attack traffic such as “slammer.pcap” (Slammer worm traffic), “teardrop.cap” (Teardrop attack with overlapping IP fragments), and various DNS exploits
- Malware-Traffic-Analysis.net: Provides information on malicious network traffic and malware samples
- Custom captures: Generated using Wireshark with appropriate capture filters
8.3 Traffic Replay Execution
Before replaying, use tcprewrite to change the addresses so they match the test network. The steps:
- Analyze the original capture to identify required address translations
- Apply tcprewrite transformations for Layer 2 and Layer 3 addresses
- Optionally use tcpprep for client/server classification
- Execute replay via tcpreplay with appropriate speed settings
While the replay runs, watch the IDS under test and run extra Wireshark captures at a few points on the network.
9. Educational Applications
Replay simulations teach a few things:
- Packet Literacy: Students learn to read hex dumps and interpret protocol fields, going past the tool’s summary view to the data underneath (Chappell, 2017).
- Understanding Anti-Replay Measures: By successfully replaying a packet, students identify what header fields (e.g., Timestamp, Nonce, Sequence Number) are absent in vulnerable protocols. This ties back to the anti-replay concepts in cryptographic standards.
- Incident Response: Analyzing replayed packets helps security teams understand how attackers move laterally within a network by reusing valid credentials or communication structures.
10. Ethical and Legal Considerations
Security testing needs explicit authorization and a clearly defined scope. Wireshark is powerful, and simulating replay attacks is bound by ethical and legal limits.
10.1 Authorization Requirements
NIST SP 800-115 emphasizes that penetration testing “should be performed only after careful consideration, notification, and planning” and identifies specific documentation requirements including “rules are identified, management approval is finalized and documented, and testing goals are set” during the planning phase (Scarfone et al., 2008, p. 5-2).
The system owner must authorize network analysis and intrusion testing. It is “crucial to cover all legal angles” including “obtaining written consent from system owners and ensuring compliance with relevant laws and regulations” (RSI Security, 2024). Write down the Rules of Engagement (ROE) before any assessment starts.
10.2 Environment Isolation
Keep simulations inside isolated lab environments (for example virtual machines) that never touch production data or the public internet, and only test systems you are explicitly authorized to test. Replay of captured traffic against systems outside the defined scope constitutes unauthorized access under applicable computer crime statutes.
10.3 Data Handling
Handle and destroy captures that contain sensitive data according to your organization’s policies and the regulations that apply. Packet captures often contain personally identifiable information (PII) so store them securely (Cisco, 2025).
11. Conclusion
Wireshark for capture and analysis plus Tcpreplay for injection gives you a practical way to check whether your network defenses work. The method follows NIST SP 800-115 and lets you test intrusion detection and prevention systems against known attack patterns in a repeatable way.
With packet replay, professionals and students can simulate ARP poisoning, TCP replay, and authentication replay in a controlled setting. Doing it by hand teaches how the protocols work and why they need anti-replay fields.
Doing this well takes knowledge of the protocols, an isolated environment, and strict attention to the ethical and legal rules. Within those limits, replay is a useful way to assess your security posture, validate your defenses, and teach.
References
- AppNeta. (2025). Tcpreplay overview. Retrieved from https://tcpreplay.appneta.com/wiki/overview.html
- Chappell, L. (2017). Wireshark Network Analysis: Official Wireshark Certified Network Analyst Study Guide (3rd ed.). John Wiley & Sons.
- Cisco. (2025). Capture and analyze network traffic with Wireshark for diagnostics. Retrieved from https://www.cisco.com/c/en/us/support/docs/security/umbrella/225250-capture-and-analyze-network-traffic.html
- Day, D., Flores, B., & Matthews, J. (2013). Quantitative analysis of intrusion detection systems: Snort and Suricata. Proceedings of SPIE. Retrieved from https://people.clarkson.edu/~jmatthew/publications/SPIE_SnortSuricata_2013.pdf
- Endace. (2025). PCAP files explained. Retrieved from https://www.endace.com/learn/what-is-a-pcap-file
- Fielding, R. T., & Reschke, J. (2014). Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing. RFC 7230. Internet Engineering Task Force (IETF). https://tools.ietf.org/html/rfc7230
- Fortinet. (2025). SNORT – Network intrusion detection and prevention system. Retrieved from https://www.fortinet.com/resources/cyberglossary/snort
- GeeksforGeeks. (2020). Wireshark – Packet capturing and analyzing. Retrieved from https://www.geeksforgeeks.org/computer-networks/wireshark-packet-capturing-and-analyzing/
- IETF. (2025). PCAP capture file format (draft-ietf-opsawg-pcap). Retrieved from https://datatracker.ietf.org/doc/draft-ietf-opsawg-pcap/
- Kali Linux Tools. (2025). tcpreplay. Retrieved from https://www.kali.org/tools/tcpreplay/
- Kaufman, C., Perlman, R., & Speciner, M. (2011). Network Security: Private Communication in a Public World (2nd ed.). Prentice Hall.
- NIST. (2013). Computer Security Incident Handling Guide (NIST Special Publication 800-61 Rev. 2). U.S. Department of Commerce.
- RSI Security. (2024). NIST’s penetration testing recommendations explained. Retrieved from https://blog.rsisecurity.com/nists-penetration-testing-recommendations-explained/
- Scarfone, K., Souppaya, M., Cody, A., & Orebaugh, A. (2008). Technical guide to information security testing and assessment (NIST Special Publication 800-115). National Institute of Standards and Technology. https://doi.org/10.6028/NIST.SP.800-115
- Secureworks. (2025). Dalton: Suricata, Snort and Zeek IDS rule and pcap testing system. GitHub. Retrieved from https://github.com/secureworks/dalton
- Stamus Networks. (2025). Suricata vs Snort. Retrieved from https://www.stamus-networks.com/suricata-vs-snort
- Stevens, W. R. (1994). TCP/IP Illustrated, Volume 1: The Protocols. Addison-Wesley.
- tcpdump.org. (2025). pcap(3PCAP) man page. Retrieved from https://www.tcpdump.org/manpages/pcap.3pcap.html
- TechTarget. (2025). How to use tcpreplay to replay network packet files. Retrieved from https://www.techtarget.com/searchsecurity/tutorial/How-to-use-tcpreplay-to-replay-network-packet-files
- Wireshark Foundation. (n.d.). Wireshark Developer’s Guide. https://www.wireshark.org/docs/wsug_html_chunked/
- Wireshark Foundation. (2025). Wireshark: Go deep. Retrieved from https://www.wireshark.org/
- Wireshark Foundation. (2025). Wireshark User’s Guide. Retrieved from https://www.wireshark.org/docs/wsug_html_chunked/
- Wireshark Wiki. (2025). SampleCaptures. Retrieved from https://wiki.wireshark.org/samplecaptures
