tcprewrite修改pcap中的端口报错的原因及解决？

Question

本地tcpdump生成了一个文件

sudo tcpdump -i lo0 -nn -s0 -v src port 8090 -c 10 -w test.pcap

➜  ~ tcpdump -r test.pcap
reading from PCAP-NG file test.pcap
12:44:49.420935 IP localhost.8090 > localhost.52238: Flags [P.], seq 1935661700:1935661714, ack 3719210202, win 6379, options [nop,nop,TS val 746872393 ecr 746871394], length 14
12:44:49.420965 IP localhost.8090 > localhost.52238: Flags [P.], seq 0:14, ack 1, win 6379, options [nop,nop,TS val 746872393 ecr 746871394], length 14
12:44:50.426591 IP localhost.8090 > localhost.52238: Flags [P.], seq 14:28, ack 1, win 6379, options [nop,nop,TS val 746873398 ecr 746872393], length 14
...

现在想修改一下dest port 52238 ==> 52286 便于回放该dump文件 发送数据给当前的客户端（52286）

➜  ~ lsof -i:8090
COMMAND     PID  USER   FD   TYPE             DEVICE SIZE/OFF NODE NAME
Shadowsoc  1097 zhugw    5u  IPv4 0xe7dccacf94a472b5      0t0  TCP *:8090 (LISTEN)
java      34607 zhugw   40u  IPv6 0xe7dccacfb3a69df5      0t0  TCP localhost:8090 (LISTEN)
java      34607 zhugw   49u  IPv6 0xe7dccacfb3a6a975      0t0  TCP localhost:8090->localhost:52286 (ESTABLISHED)
java      34610 zhugw   45u  IPv6 0xe7dccacfb3a6c635      0t0  TCP localhost:52286->localhost:8090 (ESTABLISHED)

但修改的时候 报了下面的错

➜  ~ tcprewrite --portmap=52238:52286 --infile=test.pcap --outfile=test2.pcap

Fatal Error: From plugins/dlt_null/null.c:dlt_null_encode() line 207:
DLT_NULL and DLT_LOOP plugins do not support packet encoding

不知道该如何解决这个问题？或者有没其他的方案可以修改端口？

Answer 1

一种解决方案 但不确定是不是正确的解决方案

下面的命令能够成功修改端口

tcprewrite --portmap=52238:52286 --dlt=enet --enet-smac=00:55:22:AF:C6:37 --enet-dmac=00:55:22:AF:C6:37 --infile=test.pcap --outfile=test2.pcap

➜  ~ tcpdump -r test2.pcap
reading from file test2.pcap, link-type EN10MB (Ethernet)
12:44:49.420935 IP localhost.8090 > localhost.52286: Flags [P.], seq 1935661700:1935661714, ack 3719210202, win 6379, options [nop,nop,TS val 746872393 ecr 746871394], length 14
12:44:49.420965 IP localhost.8090 > localhost.52286: Flags [P.], seq 0:14, ack 1, win 6379, options [nop,nop,TS val 746872393 ecr 746871394], length 14
12:44:50.426591 IP localhost.8090 > localhost.52286: Flags [P.], seq 14:28, ack 1, win 6379, options [nop,nop,TS val 746873398 ecr 746872393], length 14