# Install tcpreplay with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper Replay saved tcpdump files at arbitrary speeds. Version 4.5.2 via Homebrew; verified 2026-06-22. ## Install ```sh sudo av install brew:tcpreplay ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install tcpreplay ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install tcpreplay ``` Evidence: MacPorts ports tree: net/tcpreplay/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add tcpreplay ``` Evidence: Alpine Linux edge package indexes: tcpreplay from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install tcpreplay ``` Evidence: Debian stable package indexes: tcpreplay from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install tcpreplay ``` Evidence: Fedora Rawhide package metadata: tcpreplay from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#tcpreplay ``` Evidence: nixpkgs package indexes: pkgs/by-name/tc/tcpreplay/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - pacman (92%): ```sh sudo pacman -S tcpreplay ``` Evidence: Arch Linux sync databases: tcpreplay from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install tcpreplay ``` Evidence: openSUSE Tumbleweed package metadata: tcpreplay from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ## Package facts - **Package key:** brew:tcpreplay - **Package manager:** Homebrew - **Package manager page:** - **Version:** 4.5.2 - **Source summary:** Replay saved tcpdump files at arbitrary speeds - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** BSD-2-Clause AND BSD-3-Clause AND BSD-4-Clause AND GPL-3.0-or-later AND ISC - **Source archive:** - **Last updated:** 2026-06-22T14:06:26-07:00 - **Generated:** 2026-07-08T07:18:31+00:00 ## Executables - tcpbridge (cli) - tcpcapinfo (cli) - tcpliveplay (cli) - tcpprep (cli) - tcpreplay (cli) - tcpreplay-edit (cli) - tcprewrite (cli) - tcpbridge (alias) - tcpcapinfo (alias) - tcpliveplay (alias) - tcpprep (alias) - tcpreplay (alias) - tcpreplay-edit (alias) - tcprewrite (alias) ## Dependencies - libdnet ## Build dependencies - autoconf - automake - libtool ## Uses from macOS - libpcap ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, arm64_ventura, sonoma, ventura, x86_64_linux ## Freshness - Page generated: 2026-07-08 - Package-manager version: 4.5.2 - Package-manager updated: 2026-06-22 - Local data: ok - Upstream repository: https://github.com/appneta/tcpreplay - info: No cached GitHub release or tag data was available. ## Project history and usage Tcpreplay is a Unix-oriented suite for editing and replaying packet captures. In package-manager catalogs it sits in the practical network-testing niche: a toolset for turning saved tcpdump or Wireshark traffic into repeatable traffic-generation, firewall, IDS, IPS, NetFlow, and lab tests. ### Project history The project traces its own history to Matt Undy of Anzen Computing, who released version 1.0.1 as part of the nidsbench toolkit in 1999. Development later passed through separate 2001 efforts by Matt Bing at NFR and Aaron Turner at OneSecure, after which Turner and Bing continued development together and the project gained major rewrites plus companion tools. A later maintainer handoff came in 2013, when Fred Klassen, sponsored by AppNeta, took over maintenance. The official history page identifies version 4.0.0 as Klassen's first major release, and the overview describes version 4.0 as the point where Tcpreplay was expanded for IP Flow and NetFlow testing, higher playback accuracy, flow statistics, and netmap-based high-speed replay. ### Adoption history The official overview says Tcpreplay is used by firewall, IDS, IPS, NetFlow and other networking vendors, enterprises, universities, labs, and open source projects. The supplied package metadata shows the same package name across Homebrew, Debian, Ubuntu, Fedora/DNF, Arch, Alpine, MacPorts, Nix, and openSUSE, which matches its role as a standard Unix networking utility rather than a single-platform app. ### How it is used The suite replays pcap files at chosen speeds, edits packets on the fly, classifies client and server traffic, rewrites Layer 2 through Layer 4 headers, bridges traffic, inspects captures, and prepares captures for replay. Typical package-nerd use is to install it next to tcpdump, Wireshark, and libpcap tooling, then use saved captures as reproducible network fixtures. ### Why package nerds care Tcpreplay matters because it is the boring, scriptable answer to a recurring lab problem: replay this exact capture again, faster, slower, edited, looped, or through a particular interface. Its many helper executables make the package larger than a single CLI, but they also make it a recognizable toolbox for traffic-generator and packet-capture workflows. ### Timeline - 1999: Matt Undy released tcpreplay 1.0.1 as part of nidsbench. - 2001: Matt Bing and Aaron Turner independently resumed work, then continued development together. - 2013: Fred Klassen, sponsored by AppNeta, took over maintenance. - 4.0.0: First major AppNeta-sponsored release, with NetFlow/IP Flow-oriented enhancements. - 2024: Official installation page listed the 4.5.1 release and release announcement. ### Related projects - tcpdump and Wireshark provide common capture inputs; libpcap underlies capture-file handling; netmap and AF_XDP appear in the official documentation as high-performance packet I/O paths; tcpprep, tcprewrite, tcpreplay-edit, tcpbridge, tcpcapinfo, and tcpliveplay are companion tools in the suite. ### Sources - - - - - input source_facts.package-manager ## Security Notes generalized runtime or code generation signal. - **Geiger risk:** yellow / medium - generalized runtime or code generation signal ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** tcpreplay - **Version Scheme:** 0 - **Revision:** 0 - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** stable ## Other Package-Manager Records - Debian apt - tcpreplay - 4.5.1-1: normalized package name match | Debian stable package indexes: tcpreplay from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Tool to replay saved tcpdump files at arbitrary speeds | http://tcpreplay.appneta.com/ - Nix - tcpreplay: normalized package name match | nixpkgs package indexes: pkgs/by-name/tc/tcpreplay/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1 - Ubuntu apt - tcpreplay - 4.4.4-1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: tcpreplay from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Tool to replay saved tcpdump files at arbitrary speeds | http://tcpreplay.appneta.com/ - apk - tcpreplay - 4.5.2-r1: normalized package name match | Alpine Linux edge package indexes: tcpreplay from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Replay captured network traffic | https://tcpreplay.appneta.com/ - apk - tcpreplay-doc - 4.5.2-r1: normalized package name match | Alpine Linux edge package indexes: tcpreplay-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | Replay captured network traffic (documentation) | https://tcpreplay.appneta.com/ - dnf - tcpreplay - 4.5.2-2.fc44: normalized package name match | Fedora Rawhide package metadata: tcpreplay from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Replay captured network traffic | http://tcpreplay.appneta.com/ - pacman - tcpreplay - 4.5.2-1: normalized package name match | Arch Linux sync databases: tcpreplay from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Gives the ability to replay previously captured traffic in a libpcap format | https://tcpreplay.appneta.com - zypper - tcpreplay - 4.5.2-1.3: normalized package name match | openSUSE Tumbleweed package metadata: tcpreplay from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | Network analysis and testing tools | https://tcpreplay.appneta.com/ - MacPorts - tcpreplay: normalized package name match | MacPorts ports tree: net/tcpreplay/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ## Related links - [Secret-risk packages](https://www.automicvault.com/pkg/secret-risk-packages/) - Has protected-tool coverage, approval-gate, or non-low Geiger security signals. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Developer build packages](https://www.automicvault.com/pkg/developer-build-tools/) - Matched build, compiler, generator, or developer workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [libdnet](https://www.automicvault.com/pkg/brew/libdnet/) - Runtime dependency declared by Homebrew. - [autoconf](https://www.automicvault.com/pkg/brew/autoconf/) - Build dependency declared by Homebrew. - [automake](https://www.automicvault.com/pkg/brew/automake/) - Build dependency declared by Homebrew. - [libtool](https://www.automicvault.com/pkg/brew/libtool/) - Build dependency declared by Homebrew. - [bittwist](https://www.automicvault.com/pkg/brew/bittwist/) - Shares av.db curated category or tags: cli, network-testing, networking, pcap. - [daemonlogger](https://www.automicvault.com/pkg/brew/daemonlogger/) - Shares av.db curated category or tags: cli, networking, pcap. - [dhcpdump](https://www.automicvault.com/pkg/brew/dhcpdump/) - Shares av.db curated category or tags: cli, networking, pcap. - [dnsperf](https://www.automicvault.com/pkg/brew/dnsperf/) - Shares av.db curated category or tags: cli, network-testing, networking. - [flowgrind](https://www.automicvault.com/pkg/brew/flowgrind/) - Shares av.db curated category or tags: cli, networking, traffic-generator. - [httpflow](https://www.automicvault.com/pkg/brew/httpflow/) - Shares av.db curated category or tags: cli, networking, pcap. - [ipsumdump](https://www.automicvault.com/pkg/brew/ipsumdump/) - Shares av.db curated category or tags: cli, networking, pcap. - [miruo](https://www.automicvault.com/pkg/brew/miruo/) - Shares av.db curated category or tags: cli, networking, pcap. ## Combined YAML source View the package source record on GitHub. [combined/tcpreplay.yml](https://github.com/automic-vault/db/blob/main/combined/tcpreplay.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph