Raw PCAP replay

Raw PCAP replay retransmits captured Ethernet frames through libpcap/Npcap with the packet timing stored in the capture. It is intended for receiver and network test benches that must see captured packet headers, not only the UDP payload.

Raw PCAP is available only for a PCAP source in Recast or Play and Recast mode and requires the Recast license. A stream can have several Raw PCAP targets together with normal UDP, UDS, SRT, and WebRTC targets. Each target has its own bounded queue, so a blocked interface or target error does not delay playback or other outputs.

Raw replay versus normal UDP replay

A normal UDP target gives the selected UDP payload to the operating system. The host creates new Ethernet, IP, and UDP headers, selects a source address, performs routing and neighbor discovery, and may fragment according to normal socket rules.

A Raw PCAP target injects an Ethernet frame directly on a selected interface:

  • Original sends the captured frame byte for byte.
  • Rewrite changes only the Ethernet destination MAC, IPv4 destination address, and UDP destination port. It recalculates the IPv4 header checksum and a valid UDP checksum.
  • Captured source MAC, source IPv4 address, source UDP port, VLAN tags, IPv4 options, DSCP, TTL, UDP payload, and Ethernet padding are preserved.
  • Capture timestamps drive replay scheduling in both modes.

Configure a target

  1. Select a PCAP/PCAPNG file and one UDP flow.
  2. Set the stream mode to Recast or Play and Recast.
  3. Add an output and select Raw PCAP.
  4. Select the PCAP output interface.
  5. Select Original frame or Rewrite destination.
  6. For rewrite mode, enter the destination IPv4 address and UDP port.
  7. For unicast, enter the next-hop destination MAC. For multicast and broadcast, SkyView derives the MAC.
  8. Leave source spoofing disabled unless the captured source IPv4 address is intentionally not assigned to the output interface.
  9. Wait for preflight to succeed before saving.

The default queue holds 256 frames and drops the oldest frame when full. Drops and rewrite/injection errors are isolated to the affected target and appear in its output statistics.

Destination MAC rules

For IPv4 multicast, SkyView derives the standard 01:00:5e:xx:xx:xx Ethernet destination from the lower 23 bits of the multicast address. Limited and directed broadcast use ff:ff:ff:ff:ff:ff.

For unicast, enter the MAC of the next hop on the selected link. This is the receiver MAC only when the receiver is on-link; otherwise use the router MAC. Raw injection intentionally does not perform ARP or route lookup.

Prerequisites

The server must be built with the gopacket build tag. Linux requires libpcap development/runtime packages and permission to open the interface for injection (normally CAP_NET_RAW/CAP_NET_ADMIN or an equivalent service policy). Windows requires Npcap in WinPcap-compatible mode and permission to open the selected \Device\NPF_{...} adapter.

rawPcapAvailable in server configuration reports whether the build contains raw injection support. Interface discovery reports device mapping, addresses, MTU, flags, link type, injection-open status, and permission errors.

Supported captures and limitations

Version 1 supports Ethernet link type, optional single or stacked VLAN tags, IPv4, and UDP. Preflight validates a bounded sample of the selected flow for fast configuration, and every frame is validated again while replaying.

The following are rejected with an explicit error:

  • IPv6
  • fragmented IPv4
  • truncated Ethernet, IPv4, or UDP data
  • non-UDP packets selected for raw replay
  • raw-IP, Linux cooked/SLL, loopback, or other non-Ethernet link types
  • packets whose IPv4 length exceeds the selected interface MTU

Original mode is still limited to the supported V1 frame shape so a saved target cannot later encounter an unsupported selected-flow packet.

What preflight guarantees

Preflight verifies the managed Host Media path, a representative sample of the selected UDP flow, MTU, interface existence/up state, Ethernet link type, multicast capability, source-IP ownership policy, destination MAC rules, and whether libpcap/Npcap can open the device. A malformed or unsupported packet encountered later is dropped and reported by that target without blocking sibling outputs.

Preflight cannot verify an external switch ACL, port-security or anti-spoofing policy, VLAN membership beyond the transmitted tag, downstream multicast configuration, routing, receiver reachability, or whether another host accepts the traffic. Network state can also change after save, so runtime repeats preflight before starting the target.

Error codes

Code Corrective action
RAW_PCAP_UNAVAILABLE Install libpcap/Npcap and use a build with the gopacket tag.
INTERFACE_NOT_FOUND Refresh interfaces and select the PCAP device mapped to the intended local adapter.
INTERFACE_DOWN Bring the adapter up; for multicast, select a multicast-capable adapter.
INJECTION_OPEN_DENIED Grant packet-injection permission or correct the Npcap/libpcap installation.
UNSUPPORTED_LINK_TYPE Use an Ethernet capture and Ethernet output device.
UNSUPPORTED_IP_VERSION Select an IPv4 UDP flow; IPv6 rewriting is not supported in V1.
FRAGMENTED_PACKET_UNSUPPORTED Capture or generate unfragmented IPv4 UDP packets.
DESTINATION_MAC_REQUIRED Enter the unicast next-hop MAC address.
SOURCE_IP_NOT_OWNED Select an interface owning the captured source IP or explicitly enable spoofing.
MTU_EXCEEDED Increase interface MTU or use a capture whose IPv4 packets fit.
INVALID_REWRITE Correct the mode, IPv4 address, UDP port, MAC, queue, capture path, or selected flow.

Verify transmission

On Linux:

sudo tcpdump -i eth0 -e -nn -vvv 'udp and host 239.10.10.10 and port 6000'

To compare original mode, save the transmitted capture and compare the selected frames with the source capture in Wireshark. For rewrite mode, verify the destination MAC, IPv4 destination, UDP destination port, IPv4 checksum, UDP checksum, unchanged payload, VLAN tags, source fields, and inter-packet timing.

On Windows, capture the same Npcap adapter in Wireshark and filter with:

udp && ip.dst == 239.10.10.10 && udp.dstport == 6000

Security

Original mode and spoof-enabled rewrite mode can transmit source identities that do not belong to the host. Use them only on authorized test networks. Spoofed traffic may bypass assumptions in monitoring tools, trigger security controls, or violate organizational policy. Keep spoofing disabled by default and document the test owner, interface, capture provenance, and permitted destinations.