macOS
Homebrewverified · 100%
brew install tcpreplaylocal Homebrew formula metadata
MacPortsverified · 94%
sudo port install tcpreplayMacPorts ports tree · net/tcpreplay/Portfile · source: api.github.com
brew
Install tcpreplay with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper
Replay saved tcpdump files at arbitrary speeds. Version 4.5.2 via Homebrew; verified 2026-06-22.
install
Additional install commands
Linux
Alpine Linux apkverified · 92%
sudo apk add tcpreplayAlpine Linux edge package indexes · tcpreplay · source: dl-cdn.alpinelinux.org
Debian aptverified · 92%
sudo apt install tcpreplayDebian stable package indexes · tcpreplay · source: deb.debian.org
Fedora dnfverified · 92%
sudo dnf install tcpreplayFedora Rawhide package metadata · tcpreplay · source: dl.fedoraproject.org
Nixverified · 92%
nix profile install nixpkgs#tcpreplaynixpkgs package indexes · pkgs/by-name/tc/tcpreplay/package.nix · source: api.github.com
Arch Linux pacmanverified · 92%
sudo pacman -S tcpreplayArch Linux sync databases · tcpreplay · source: geo.mirror.pkgbuild.com
openSUSE zypperverified · 92%
sudo zypper install tcpreplayopenSUSE Tumbleweed package metadata · tcpreplay · source: download.opensuse.org
overview
Package summary
Replay saved tcpdump files at arbitrary speeds
Project links
Commands and aliases
- tcpbridge
- tcpcapinfo
- tcpliveplay
- tcpprep
- tcpreplay
- tcpreplay-edit
- tcprewrite
history
Project history and usage
Tcpreplay is a Unix-oriented suite for editing and replaying packet captures. In package-manager catalogs it sits in the practical network-testing niche: a toolset for turning saved tcpdump or Wireshark traffic into repeatable traffic-generation, firewall, IDS, IPS, NetFlow, and lab tests.
Project history
The project traces its own history to Matt Undy of Anzen Computing, who released version 1.0.1 as part of the nidsbench toolkit in 1999. Development later passed through separate 2001 efforts by Matt Bing at NFR and Aaron Turner at OneSecure, after which Turner and Bing continued development together and the project gained major rewrites plus companion tools.
A later maintainer handoff came in 2013, when Fred Klassen, sponsored by AppNeta, took over maintenance. The official history page identifies version 4.0.0 as Klassen's first major release, and the overview describes version 4.0 as the point where Tcpreplay was expanded for IP Flow and NetFlow testing, higher playback accuracy, flow statistics, and netmap-based high-speed replay.
Adoption history
The official overview says Tcpreplay is used by firewall, IDS, IPS, NetFlow and other networking vendors, enterprises, universities, labs, and open source projects. The supplied package metadata shows the same package name across Homebrew, Debian, Ubuntu, Fedora/DNF, Arch, Alpine, MacPorts, Nix, and openSUSE, which matches its role as a standard Unix networking utility rather than a single-platform app.
How it is used
The suite replays pcap files at chosen speeds, edits packets on the fly, classifies client and server traffic, rewrites Layer 2 through Layer 4 headers, bridges traffic, inspects captures, and prepares captures for replay. Typical package-nerd use is to install it next to tcpdump, Wireshark, and libpcap tooling, then use saved captures as reproducible network fixtures.
Why package nerds care
Tcpreplay matters because it is the boring, scriptable answer to a recurring lab problem: replay this exact capture again, faster, slower, edited, looped, or through a particular interface. Its many helper executables make the package larger than a single CLI, but they also make it a recognizable toolbox for traffic-generator and packet-capture workflows.
Timeline
- 1999: Matt Undy released tcpreplay 1.0.1 as part of nidsbench.
- 2001: Matt Bing and Aaron Turner independently resumed work, then continued development together.
- 2013: Fred Klassen, sponsored by AppNeta, took over maintenance.
- 4.0.0: First major AppNeta-sponsored release, with NetFlow/IP Flow-oriented enhancements.
- 2024: Official installation page listed the 4.5.1 release and release announcement.
Related projects
- tcpdump and Wireshark provide common capture inputs; libpcap underlies capture-file handling; netmap and AF_XDP appear in the official documentation as high-performance packet I/O paths; tcpprep, tcprewrite, tcpreplay-edit, tcpbridge, tcpcapinfo, and tcpliveplay are companion tools in the suite.
Sources
security posture
Risk level: yellow
generalized runtime or code generation signal.
Risk classifier
yellow risk · medium confidence · runtime
Why
- generalized runtime or code generation signal
Signals
- text:repl
Install behavior
- No Homebrew post-install hook is recorded in formula metadata.
- Homebrew bottle metadata is available for 8 platform targets.
- Installs with 1 runtime dependencies.
- Build metadata lists 3 build dependencies.
Recommended review
Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.
executables
Installed executables
| Command | Kind | Exposure | Note |
|---|---|---|---|
tcpbridge | cli | global executable | |
tcpcapinfo | cli | global executable | |
tcpliveplay | cli | global executable | |
tcpprep | cli | global executable | |
tcpreplay | cli | global executable | |
tcpreplay-edit | cli | global executable | |
tcprewrite | cli | global executable |
freshness
Version and freshness
These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.
page generated2026-07-08
manager version4.5.2
manager updated2026-06-22
local dataok
upstreamnot checked
latest detectednot detected
https://github.com/appneta/tcpreplay
- infoNo cached GitHub release or tag data was available.https://github.com/appneta/tcpreplaynone confidence
install metadata
Package metadata
| Package key | brew:tcpreplay |
|---|---|
| Version | 4.5.2 |
| Package manager | Homebrew |
| Package manager page | https://formulae.brew.sh/formula/tcpreplay |
| Homepage | https://tcpreplay.appneta.com/ |
| Repository | https://github.com/appneta/tcpreplay |
| Upstream docs | https://tcpreplay.appneta.com/wiki |
| License | BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND GPL-3.0-or-later AND ISC |
| Source archive | https://github.com/appneta/tcpreplay/releases/download/v4.5.2/tcpreplay-4.5.2.tar.gz |
| Last updated | 2026-06-22T14:06:26-07:00 |
| Pulse | updated |
| Dependencies | libdnet |
| Build dependencies | autoconf, automake, libtool |
| Uses from macOS | libpcap |
| Bottle | available (on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, sonoma, ventura, x86_64_linux) |
| Homebrew post-install | not defined |
| Service | none declared |
registry facts
Source database details
| Source Database | Homebrew formula API |
|---|---|
| Tap | homebrew/core |
| Full Name | tcpreplay |
| Version Scheme | 0 |
| Revision | 0 |
| Bottle Stable Root URL | https://ghcr.io/v2/homebrew/core |
| Deprecated | no |
| Disabled | no |
| Keg Only | no |
| URL Keys |
|
source database matches
Other package-manager records
Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.
Debian apt95%
tcpreplay 4.5.1-1
Tool to replay saved tcpdump files at arbitrary speeds
sudo apt install tcpreplay- Section: net
- Architecture: amd64
- 3 dependencies
- normalized package name match
- Matched by: Tcpreplay
Nix95%
tcpreplay
nix profile install nixpkgs#tcpreplay- normalized package name match
- Matched by: Tcpreplay
Ubuntu apt95%
tcpreplay 4.4.4-1build2
Tool to replay saved tcpdump files at arbitrary speeds
sudo apt install tcpreplay- Section: universe/net
- Architecture: amd64
- 3 dependencies
- normalized package name match
- Matched by: Tcpreplay
apk95%
tcpreplay 4.5.2-r1
Replay captured network traffic
https://tcpreplay.appneta.com/
sudo apk add tcpreplay- License: GPL-3.0-or-later
- Architecture: x86_64
- Source Package: tcpreplay
- 1 dependencies
- 1 provides
- normalized package name match
- Matched by: Tcpreplay
apk95%
tcpreplay-doc 4.5.2-r1
Replay captured network traffic (documentation)
https://tcpreplay.appneta.com/
sudo apk add tcpreplay-doc- License: GPL-3.0-or-later
- Architecture: x86_64
- Source Package: tcpreplay
- normalized package name match
- Matched by: Tcpreplay
dnf95%
tcpreplay 4.5.2-2.fc44
Replay captured network traffic
sudo dnf install tcpreplay- License: GPL-3.0-only
- Category: Unspecified
- Architecture: x86_64
- Source Package: tcpreplay
- 5 dependencies
- 1 provides
- normalized package name match
- Matched by: Tcpreplay
pacman95%
tcpreplay 4.5.2-1
Gives the ability to replay previously captured traffic in a libpcap format
sudo pacman -S tcpreplay- License: GPL-3.0-only
- Architecture: x86_64
- 3 dependencies
- 1 optional deps
- normalized package name match
- Matched by: Tcpreplay
zypper95%
tcpreplay 4.5.2-1.3
Network analysis and testing tools
https://tcpreplay.appneta.com/
sudo zypper install tcpreplay- License: GPL-3.0-only
- Category: Productivity/Networking/Diagnostic
- Architecture: x86_64
- Source Package: tcpreplay
- 4 dependencies
- 1 provides
- normalized package name match
- Matched by: Tcpreplay
MacPorts95%
tcpreplay
sudo port install tcpreplay- normalized package name match
- Matched by: Tcpreplay
source trail
Generated from repository data
This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.
Combined YAML source
View the package source record on GitHub.
Used sources
- Geiger risk classifier
- Nucleus package database
- av.db category and tag curation
- cross-ecosystem install command graph
- curated package history
- external package-manager database matches
- package relationship graph
- package version freshness
- package-page enrichment