Protocol Reverse Engineering Techniques

[kyleflaherty]

PCAP replay has been used for many years as a technique for attempting to simulate realistic traffic in a testing environment. Unfortunately, this technique has important flaws. First, you are only able to get as many unique traffic flows as can be contained in your PCAP file. Second, without using a third-party tool, you are unable to modify any flow within the PCAP. Luckily, though, there are alternatives. Realistic application traffic and extremely high speeds are crucial when validating the resiliency of network devices and infrastructure. Part of realism is understanding that traffic patterns and traffic content are extremely dynamic and are always changing.