Tool to sanitize packets

asked 2019-08-09 21:01:53 +0000

genesiusj
1 ●3 ●6 ●6

Hello, Can Wireshark (or one of its CLI-based programs) able to either sanitize packets (need to remove PII); or edit TCP payload to all of one character; or remove packets (without causing TCP errors in the output)? We have several captures which contain PII, there is valuable technical information that would be of benefit in resolving future issues. Therefore, we would love to keep the captures minus the PII. Thanks and God bless, Genesius

edit retag flag offensive close merge delete

add a comment

2 Answers

Sort by » oldest newest most voted

answered 2019-08-10 01:19:45 +0000

Ross Jacobs
71 ●3 ●32 ●13

Hi Genesius,

Sanitize: You want to use TraceWrangler, made by Wireshark Contributor Jasper Bongertz.
Remove TCP payload: Use editcap with a snaplen
Remove packets: Filter them out with a display filter in Wireshark and then File > Export Specified Packets. In tshark, this is tshark -r $file -Y "$display_filter" -w $filtered_file.

I agree with @cmaynard that checking out the Wireshark Tools page will help you.

Cheers