IP Networking

Hi,

I am trying to capture manually crafted IP packets, created using Scapy, to a pcap file that can later be replayed using tcpreplay.

When using wireshark, I can successfully capture these packets and view them in wireshark.
However, when using tcpdump, these packets are then shown in wireshark as malformed packets. It seems like tcpdump wrongly parses/stores them.

Is there any difference between tcpdump and wireshark capturing? Can I configure tcpdump to capture just like wireshark does? (I tried -s 0 or -s 65536 and this did not help)

Thank you!

What is your exact tcpdump syntax? what format are you capturing in?

You could try capturing to pcap file using tshark, and seeing if tcpreplay will replay the file.

I used: tcpdump -s 0 -w <file>
Is it correct?
Does it capture in a different format than Wireshark does?

Regarding tshark - will give it a try and report. Thanks!