| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: tcpreplay | Distribution: openSUSE Tumbleweed |
| Version: 4.6.0 | Vendor: openSUSE |
| Release: 1.1 | Build date: Wed Jul 29 08:57:54 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 1151291 | Source RPM: tcpreplay-4.6.0-1.1.src.rpm |
| Packager: http://bugs.opensuse.org | |
| Url: https://tcpreplay.appneta.com/ | |
| Summary: Network analysis and testing tools | |
Tcpreplay is a suite of utilities for editing and replaying previously captured network traffic. It was originally designed to replay malicious traffic patterns to Intrusion Detection/Prevention Systems, and is meanwhile capable of replaying to web servers. It supports switches, routers and IP Flow/NetFlow appliances.
GPL-3.0-only
* Wed Jul 29 2026 Martin Pluskal <mpluskal@suse.com>
- Update to 4.6.0:
* Fixes three advisories reported by tinyb0y, none of which have a
CVE assigned yet: GHSA-fwcr-mqg6-hqmx (stack buffer overflow in
the tcpprep --services file parser), GHSA-m6w7-8497-g9c9 (heap
out-of-bounds read via --pktlen with --preload-pcap) and
GHSA-5q26-7fxx-v8fh (heap out-of-bounds access in ARP address
rewriting)
* Fix Linux TX_RING support, broken by a header and probe
collision
* Fix an out-of-bounds read in libopts --save-opts handling
* Fix jumbo-frame truncation that silently mangled captures with
frames larger than the MTU
* AF_XDP and io_uring injection backends now reach line rate; new
- -raw PF_INET/SOCK_RAW injection path and --loss option
* CMake joins autotools as a supported build system; GNU AutoGen
is no longer required and release tarballs ship pre-built files
for both
* Install the replay engine as a static C library
- Drop tcpreplay-fix-txring-includes.patch, merged upstream
- Do not ship the newly installed libtcpreplay: it is static-only,
has no configure switch to disable it and nothing in Factory links
against it, so the package stays a command-line tool set
* Sat Jul 25 2026 Martin Pluskal <mpluskal@suse.com>
- Update to version 4.5.5 - a security release:
* Fix heap buffer over-read in get_layer4_v6(), reachable by
reading an untrusted pcap with any of the tools
(GHSA-jj65-mrgg-f5fx)
* Fix stack buffer overflow in the fragroute rules-file parser
(GHSA-777w-9599-w8g4)
* Fix out-of-bounds write on an empty fragroute rules file
(GHSA-p7xp-4gj2-x56c)
* Fix off-by-one heap overflows in the fragroute ip_chaff and
tcp_chaff modules (GHSA-m655-53p4-6qm8, GHSA-v8c4-9w98-9v6v)
* Fix heap overflow via negative fragment/segment sizes in the
fragroute ip_frag and tcp_seg modules (GHSA-27v4-xhfx-g2rx)
* Harden fragroute allocation-failure and rule-list cleanup
paths and add the first fragroute test cases
* Thu Jul 23 2026 Martin Pluskal <mpluskal@suse.com>
- Update to version 4.5.4 (security-only release):
* Fix heap buffer overflow in the tcprewrite fragroute
tcp_opt module (GHSA-pfqg-243f-8q25, CWE-787, CVSS 8.4):
tcp_opt_apply() passed sizeof(pkt->pkt_data) - ETH_HDR_LEN
as the capacity bound, but pkt_data is a pointer so
sizeof() was 8 and the subtraction underflowed size_t,
disabling the bounds check and allowing an out-of-bounds
heap write. Now bounded by the real buffer extent.
* Fix heap buffer overflow in the tcprewrite fragroute
ip6_opt module (GHSA-2wmf-4p77-784q, CWE-787): IPv6
routing/extension-header insertion used memmove()/memcpy()
without checking the inserted bytes fit the remaining
buffer headroom.
* Fix the same class of unchecked option-insertion overflow
in the fragroute ip_opt module (src/fragroute/mod_ip_opt.c).
* Fix SEGV in the tcpedit DLT_JUNIPER_ETHER plugin used as a
decoder (GHSA-ww62-mxv7-pg55, CWE-704, CWE-843): the plugin
read ctx->encoder->config although it only ever decodes,
a type confusion that crashed tcpedit on DLT_JUNIPER_ETHER
input (e.g. tcprewrite --dlt=enet); now reads
ctx->decoder->config.
* Fix crash in remove_settings() on failed text_mmap
(GHSA-5cjx-62pj-pmgq, CVE-2025-8746, CWE-476): the
AutoOpts option-file save/rewrite path dereferenced the
text_mmap() result without checking for MAP_FAILED.
* Fix buffer overflow in the KHIAL sendpacket() path
(GHSA-pjh6-6hrw-vcwr, CWE-787, CVSS 6.6):
buffer_payload_size added instead of subtracted the
pcap_pkthdr size, overstating the send buffer by 48 bytes
and overflowing it for packets >= 10024 bytes.
- Drop tcpreplay-CVE-2025-8746.patch: the remove_settings()
MAP_FAILED guard (CVE-2025-8746 / GHSA-5cjx-62pj-pmgq) is
now fixed upstream in 4.5.4.
* Mon Jul 20 2026 Martin Pluskal <mpluskal@suse.com>
- Update to version 4.5.3:
* tcpreplay: fix --multiplier timing drift and miscalibrated
overflow guards in calc_sleep_time
* sendpacket: retry EAGAIN/ENOBUFS a bounded number of times
instead of retrying endlessly; warn when sending on a
down/no-carrier interface on Linux
* sendpacket: fix AF_XDP transmission by no longer inhibiting
libbpf's default XDP program load; route "zc:" PF_RING ZC
device names through libpcap
* netmap: bound and make abortable the TX-ring drain wait;
remove stray switch defaults in nm_do_ioctl() that broke
- -netmap
* tcprewrite: fix adding a VLAN tag with missing options;
rewrite addresses embedded in ICMPv6 error messages
* tcpprep: fix buffer overflow on truncated packets
* tcpedit: fix wrong end-of-buffer pointer in TCP-sequence and
portmap rewrite
* tcpliveplay: call pcap_breakloop() from the SIGALRM handler so
an unresponsive peer is reported promptly
* fragroute: fix overflow on packets carrying too many MPLS
labels; fix TAILQ_FOREACH_REVERSE portability across queue.h
variants
* tcpr_random: fix signed left-shift undefined behaviour
* configure: stop --with-netmap from leaking -I<DIR>/sys into
CFLAGS
- Convert BuildRequires to pkgconfig() style and drop the obsolete
Group tag
- Add tcpreplay-fix-txring-includes.patch: fix the __GLIBC_MINOR
typo in txring.h (the macro is __GLIBC_MINOR__, so the version
check silently evaluated to 0) and include <linux/if_packet.h>,
which is what actually defines the PACKET_TX_RING API - glibc's
<netpacket/packet.h> never provided it, so correcting the typo
alone does not compile. Sent upstream
- Restore Linux TX_RING packet injection support, which was
disabled by accident: configure probes it by including both
<netpacket/packet.h> and <linux/if_packet.h>, and before C23
those two collide on struct sockaddr_ll, so the probe always
failed and tcpreplay fell back to the slower PF_PACKET send()
path. configure now reports "Linux TX_RING: yes"
- Narrow the -std=gnu11 pin to the bundled libopts directory
rather than the whole tree. The pin is still required there
(autoopts is not C23-clean under gcc >= 15), but applying it
globally is what dragged the TX_RING probe below C23
* Thu Nov 06 2025 Michal Kubecek <mkubecek@suse.cz>
- update to version 4.5.2:
- bugfix release
- see https://github.com/appneta/tcpreplay/compare/v4.5.1...v4.5.2
for full list of changes since v4.5.1
- includes fixes for
- CVE-2025-9157 / bsc#1248322
- CVE-2025-51006 / bsc#1250356
- drop build workarounds for SLE11; since %autosetup and %license
were introduced into the specfile recently, the package would not
build on SLE11 or older anyway
* Tue Aug 19 2025 pgajdos@suse.com
- security update
- added patches
CVE-2025-8746 [bsc#1247917], improper input validation and memory bounds checking when processing certain malformed configuration files
+ tcpreplay-CVE-2025-8746.patch
* Mon Aug 18 2025 pgajdos@suse.com
- build with gcc15
* Tue Dec 10 2024 Martin Pluskal <mpluskal@suse.com>
- Update to version 4.5.1:
* AF_XDP socket support - if you have a newer Linux kernel, you will be able to transmit at line rates without having to install 3rd party kernel modules (e.g. netmap, PF_RING)
* -w tcpreplay option - this overrides the -i option, and allows you to write to a PCAP file rather than an interface
* --include and --exclude tcpreplay options - allows replay of a list of specific packet numbers to replay. This may slow things down, so consider using in combination with -w.
* --fixhdrlen tcpreplay option - added to control action on packet length changes
* -W tcpreplay option - suppress warnings when replaying
* SLL2( Linux "cooked" capture encapsulation v2)
* Haiku support
* Tue Jul 11 2023 Martin Hauke <mardnh@gmx.de>
- Update to 4.4.4:
* overflow check fix for parse_mpls.
* tcpreplay-edit: prevent L2 flooding of ipv6 unicast packets.
* CVE-2023-27786: bugs caused by strtok_r. (boo#1209416)
* CVE-2023-27783 reachable assert in tcpedit_dlt_cleanup
(boo#1209413)
* reachable assert in fast_edit_packet.
* Mon Jan 02 2023 Dirk Müller <dmueller@suse.com>
- update to 4.4.3:
* upgrade autogen/libopts to version 5.18.16
* avoid implicit int in configure.ac
* remove invalid assert in tree
* program exit after send error
* make libpcap version test more robust
* looping inflates some packet counters
/usr/bin/tcpbridge /usr/bin/tcpcapinfo /usr/bin/tcpliveplay /usr/bin/tcpprep /usr/bin/tcpreplay /usr/bin/tcpreplay-edit /usr/bin/tcprewrite /usr/share/doc/packages/tcpreplay /usr/share/doc/packages/tcpreplay/CHANGELOG /usr/share/licenses/tcpreplay /usr/share/licenses/tcpreplay/LICENSE /usr/share/man/man1/tcpbridge.1.gz /usr/share/man/man1/tcpcapinfo.1.gz /usr/share/man/man1/tcpliveplay.1.gz /usr/share/man/man1/tcpprep.1.gz /usr/share/man/man1/tcpreplay-edit.1.gz /usr/share/man/man1/tcpreplay.1.gz /usr/share/man/man1/tcprewrite.1.gz
Generated by rpm2html 1.8.1
Fabrice Bellet, Mon Aug 10 23:50:47 2026