Support Questions
Find answers, ask questions, and share your expertise
Announcements
Alert: Welcome to the Unified Cloudera Community. Former HCC members be sure to read and learn how to activate your account here.

pcap-replay preserve timestamp

pcap-replay preserve timestamp

Contributor

hi,

I need to replay pcap occasionally to my metron cluster; however pcap-replay uses tcpreplay and tcpreplay doesn't preserve original timestamp of the packet. Has anyone try to preserve the timestamp? I read that each sensor (yaf, snort, and bro) can reads the pcap file but I don't know how to replay it to the interface the same manner and format like tcpreplay so that the data can be picked up in ingested to Metron. any guidance is much appreciated