Hmmm.... haven't written anything in a while. Good news is that tcpreplay is still being actively developed. 1.3-beta6 was just released and adds a lot of cool features and fixes a ton of nasty bugs.

Anyways, the curses based interactive mode has been put on the backburner until Matt and I can hack out a pcap editing library.

Well lots of things have happened. Looks like after about four months, tcpreplay will finally be released in a few weeks. This is a really big thing as I've basically had to put futher development on hold until the 1.1 release is out the door.

I'm also looking into adding a massive new feature- a curses based interactive mode. Not sure how big of a project this is going to turn out to be, but it's looking to be the most complex bit of C code I've ever written by far.

I've also bought a Tivo (one of the AT&T models) and I must say I love the thing. Went out and got myself a 120GB harddisk for it and now I've got 197hrs of capacity... no idea what I'll do with all that time though :-)

Well I finally gave up on tsearch. Turns out it is horribly broken if you want to update entries in the tree, so finally I gave up. I found libredblack on freshmeat, and haven't looked back since.

Anyways, tcpprep development is moving along. Hopefully I should be able to release something in the next week or so, depending on how much free time I find.

Grrrrr.... I wish I could tar and feather the person who wrote the GNU tsearch manpage. If you're going to include a source code example, could you at least make sure that it works?

For those of you not aware, tsearch has a simple program which inserts 12 random numbers into a tree and prints them out. Only that because of a bug, it only prints out 6 of them.

I'll admit that I'm no C wiz, I couldn't even figure out what was wrong with the code (a friend of mine pointed out that they delete the root node after processing the left side of the tree, preventing further processing).

Anyways, now that I know that the tsearch functions aren't horribly broken, I can continue working on my code. Yippie!

Woo hoo! My lastest patch for tcpreplay is done which impliments a pre-processor (tcpprep) and cache function which dramatically improves performance for dual-nic use. Actually, performance seems to match single-nic use which was the goal.

I'm actually pretty stoked about the cache file too- it's super small. For a 900MB tcpdump file, the cache file was only 74K.

Anyways, hopefully I can get Matt to include this into the offical distribution soon. My next feature enchancement will to build some intelligence into tcpprep so it can figure out the server network vs the clients. Should prove useful for replaying in dual-nic mode unknown captures.

Anyways, for those of you who actually read this and care, here's the link to the patches: http://synfin.net/aturner/tcpreplay/