Anonymizing pcaps for sharing/analysis

edit

Thanks!.........

Tracewrangler works great. The only limitation I have bumped into is that it can only remove single VLAN tag. Use editcap to remove multiple VLAN tags.

Glad to hear it worked great for you and maybe @Jasper can add Q-in-Q (or rather, recursive) vlan scrubbing :-)

I'll have to check into that - Tracewrangler can parse stacked VLAN tags but maybe I forgot to actually add code to remove them...

Why would people want to anonymise VLAN tags? Frankly, why would people want also to remove private ip addresses? Is there any reason why you would want to anonymise anything else than mac address and payload?

VLANs and private IP addresses tell something about the internal network architecture and can be used as intel for an attack. So it is wise not to expose them unnecessarily.

@Jasper, I am using build 949 and my pcap files have three VLAN tags.

Please let me know when you have a new version to test.