Snort-replay is a simple output system for Snort (a patch for snort-2.0.1) that prints (not sends!) the payloads using the same delay between the packets as was seen on the wire. Note that this is *NOT* the same thing as tcpreplay.

Snort-replay obviously only makes sense when reading a pcap (tcpdump) file and usually making sure that you only see a conversation between two hosts and nothing else. If the pcap is good, you will get the feeling of seeing the conversation in real-time (i.e. www.takedown.com-style, but more primitive). So if you log an entire intrusion to a tcpdump file, you can then use Snort in replay mode and see the attacker's screen during the intrusion (kind of). This can be very useful for post-processing some large tcpdump files. It may also be useful for demonstrations, or even more important, as a funny party trick.

Author: Andreas Östling
Homepage: http://www.algonet.se/~nitzer/snort-replay/