I have limited networking knowledge so bear with me here on this explanation...

In my companies datacenter we have some devices that run tcpreplay traffic and usually, there are no issues as the traffic is usually run from a replay server directly to a port on a device. The issue we're having here is that it looks like an engineer accidentally pushed the pcaps out on the wrong port of the replay server and into our network flooding it with packets

There are close to 100 replay servers and each one of those has multiple connections so it's tough to track down the culprit. The packets being sent have an IP that is outside of our network so we can't track it by that or a mac address. Is there any way we can track down the replay server that's pushing these packets onto the network without having to turn off the replay servers one by one?

  • I think you are confused about the MAC address, which is only local to the LAN. MAC addresses are in the layer-2 frame header for protocols that use MAC addresses (not all do), and a router strips off and discards the frames before forwarding packets, building a new frame for the new LAN. You would never see a MAC address from a non-local device.
    – Ron Maupin
    Jul 25, 2018 at 23:10
  • What is the packet per second rate of the flooded traffic ? Jul 26, 2018 at 0:51
  • We figured out the source of the issue using wire shark. Thanks for the comments Jul 27, 2018 at 7:13
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Dec 25, 2018 at 9:05

2 Answers 2


A TCP socket is uniquely identified by the four values (remote IP, local IP, remote port, local port). Right, so use a tool like wireshark to identify the culprit!

Best of luck!


Sorry I haven't checked this in a while. We resolved the issue by running wire shark on the network and tracking down the replay server. Thanks all for your help.

  • ease accept the answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Dec 28, 2018 at 2:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.