tcpreplay not working on MacOS Mojave 10.14.1 - /dev/bpfX limit hard coded to 10

[jestacio-circle]

I am running into an issue where tcpreplay fails with the error "Fatal Error: failed to open device en0: Unable to open /dev/bpfX: Resource busy" when trying to replay a pcap file through my wifi interface (en0)

Looking at https://github.com/appneta/tcpreplay/blob/master/src/common/sendpacket.c#L1056

the maximum bpf device files tried is 10 which is hardcoded as a magic number. Increasing this by doing something like #define BPFDEV_LIMIT 10 and replacing the loop condition and array declaration seems to resolve the issue. An even better approach may be to parameterize that value by defining a new flag.

I am running MacOS Mojave 10.14.1 on a Macbook Pro 15" 2016

The brew installed version of tcpreplay has the same issue.

[fklassen]

Do you have permissions set up properly for /dev/bpf*? If not, it means that you don't have proper libpcap access. All programs that require libpcap access have had permissions issues with latest version of macOS. There are a few fixes available.

• set permissions manually, e.g. (substitute 'fklassen' with your user ID):
  sudo chown fklassen:admin /dev/bp*
• set up libpcap ChmodBPF
• install Wireshark which will install Wireshark's ChmodBPF

[jestacio-circle]

I believe my permissions were set up correctly. /dev/bpf* are owned by root:access_bpf by default and my user is part of the access_bpf group which has rw access.

On second look I misunderstood the code-the only change needed was to change the string buffer to 12 to fit something like "/dev/bpf255" and let the loop go up to 255.

Previously it was failing because bpf0-bpf9 were already in use. With those changes tcpreplay was able to open /dev/bpf17 and things started working (I ran make test and the smallFlows.pcap sample file)

[fklassen]

Definite bug. Scheduled for 4.3.3.

[fklassen]

Fixed in PR #607