Printer FriendlyEmail Article Link

Spirent TestCenter: How do I create a stream block from a packet(s) from a Wireshark .pcap file?

Environment/Versions
  • Spirent TestCenter GUI
  • Wireshark
    • Tshark
Answer

Method 1 - How to import packets from a Wireshark .pcap file into STC (aka Capture Replay)

Note that this method will create a stream block for each packet in the .pcap file.

  • To create a pcap file with only the packets you want to replay see
    SOL11891 - Wireshark: How can I select only a few packets out of a .pcap file and save it off in a new .pcap file?

Before proceeding you will need the following:

  • Configure Spirent TestCenter with the tshark.exe (installed with Wireshark). See FAQ14288 - Spirent TestCenter: How do you set the location of Tshark in the Spirent TestCenter GUI?
  • Have Tcl installed
    • It can be downloaded from https://support.spirent.com/ -> Download -> Spirent TestCenter -> TCL version for the application and firmware version on which you are testing and install.
    • Verify TCL is installed -> open command window on your PC and type tclsh, if no reply, set the path variable for TCL.
    • Open -> My Computer -> Properties -> Advanced Settings -> Environmental Variables -> System variables and configure Path to location of TCL application (you may require semicolon at the end of the path) and select ok and open new command window and verify by type tclsh, then info patchlevel

In Spirent TestCenter

  • Select the "Traffic Generator" under the port you want to replay the packet from
  • Click "Generate Stream Block"
    • If tshark.exe is not already configured, browse to find tshark (found in the wireshark directory) and click "OK"
  • Browse to locate the pcap file and click "OK"
    • This creates the stream blocks, one per packet in the .pcap
  • Set "Duration Mode" to Burst
    • typically you want to send a few of these frames and not a continuous stream of them
  • Set "Burst Size" to 1
  • Set "Burst(s)" to number of these frames you want to transmit when you start the streamblock
  • Click "Apply"
  • Start the stream block
    • To verify the frame is correct you can put this port into diagnostic loopback and capture the frame to inspect it

Method 2 - Manually build a streamblock from a Wireshark .pcap

In Wireshark

  • Open .pcap file
  • Select the packet you want to replay in the top pane
  • Right click and select "Copy" -> "Bytes" -> "Hex Stream"

In Spirent TestCenter

  • Select the "Traffic Generator" under the port you want to replay the packet from
    • Click "Add" -> "Add Raw Stream Block..."
      • "General" tab
        • "Frame Size" -> "Auto"
        • "Packet" -> Uncheck "Include Signature Field"
      • "Frame" tab
        • "Create New Frame"
          • check "Allow Invalid Packets"
          • "Data Link Layer" -> None
          • "Upper Layer Protocol" -> None
          • "Category" –> Custom
          • Click "OK"
        • "Custom Header" –> "Byte Pattern (hex)"
        • Paste (the hex stream copied from Wireshark)
      • "OK"
    • Set "Duration Mode" to Burst
      • typically you want to send a few of these frames and not a continuous stream of them
    • Set "Burst Size" to 1
    • Set "Burst(s)" to number of these frames you want to transmit when you start the streamblock
  • Click "Apply"
  • Start the stream block
    • To verify the frame is correct you can put this port into diagnostic loopback and capture the frame to inspect it