Usage of packetdrill in local or remote mode

Michael Tuexen tuexen at
Sat Oct 7 12:10:37 UTC 2017

Dear all,

as promised in the last telco, here is a description of the local and remote mode
of packetdrill when being used on FreeBSD.
I'm referring to the version available from

1. Local mode

For operating packetdrill in local mode only a single system is required. This
mode can be used to test the socket layer and the transport stack which is
implemented as part of the operating system. You can't use this mode for
testing any interaction with offloading part of the transport layer
or network layer processing to NICs. packetdrill uses tun interfaces in this mode.

When packetdrill starts it will use the next unused tun interface and deletes it
(in most cases) after running the test. This can be achieved by running

packetdrill test.pkt

I find it very useful to run a packet analyzer to observe the packets being exchanged.
This can be done by using

packetdrill --tun_dev=tun0 --persistent_tun_dev test.pkt

and running the packet analyzer on the tun0 interface. Using --tun_dev=tun0 makes sure
that the tun0 interface is used instead of creating a new one and --persistent_tun_dev
ensures that the tun interface being used is not destroyed when packetdrill stops.
This allows you to run a packet analyzer continuously on the tun interface you use
for testing.

2. Remote mode

For operating packetdrill in remote mode two systems in the same LAN are required.
This mode can be used to test the socket layer and the transport stack which is
implemented as part of the operating system and also the transport layer
interaction performed by the NIC being used for testing.

In remote mode you operate on instance of packetdrill as a server. No scripts
are specified on this instance. You run this instance by using:

packetdrill --wire_server --wire_server_dev=igb1

By specifying --wireserver you start it as a server and using --wire_server_dev=igb1
you specify which NIC will be used. On FreeBSD this is mandatory.

Let me illustrate the setup I'm using:

     nf1                                             nf2
+----------+                                    +-----------+
|          | |           |
|     igb0 |------------------------------------| igb0      |
|          |                                    |           |
|          | |           |
|     igb1 |------------------------------------| igb1      |
|          |                                    |           |
+----------+                                    +-----------+

I run the server instance on nf2. The system under test is nf2 using the
igb1 interface. To run a test, I execute on nf1:

packetdrill --wire_client --wire_client_dev=igb1 --wire_server_ip=

This way the two packetdrill instances will communication using the
network (using the igb0 interfaces) and the test traffic will be on the igb1 interfaces.

To observer traffic, I can run a packet analyzer on the igb1 interfaces.

If you don't have the possibility to separate the traffic assuming that you have
only a single NIC on both machines, you could also run:

packetdrill --wire_server --wire_server_dev=igb0

on nf2 and on nf1

packetdrill --wire_client --wire_client_dev=igb0 --wire_server_ip=

That way you would test the offloading of igb0 but when capturing traffic there,
you would see the test traffic and the "management traffic" of packetdrill.

General note:
Please note that packetdrill does some IP configuration on both systems. This might
interfere with what you use. There are command line options to change that. So let
me know if you run into problems.

Best regards

PS: Possibly I should take the time to write this kind of things up in man-pages...

More information about the freebsd-transport mailing list