Ethereal-users: Re: [ethereal-users] anonymize capture file?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxxxxx>
Date: Thu, 7 Sep 2000 13:36:43 -0700
On Thu, Sep 07, 2000 at 12:57:57PM +0200, Johannes Faerber wrote:
> - If using output to sdtout ( to pipe into scripts to filter out the
>   critical fields), tethereal does not print long HTTP fields
>   completely (cuts after sth like 66 characters and adds "..."). Is
>   there a possibility to make it print the complete fields?

Yes, but it doesn't involve changing "tethereal.c", it involves changing
"packet.c" to make the "format_text()" routine dynamically grow the
string buffer into which it formats the text (i.e., it's not as if the
top-level Tethereal code - or the HTTP dissector, for that matter - is
making the decision to truncate stuff).

> Of course it would be perfect to have tethereal write directly
> anonymized packet data. Is that feasible? Or does it dump packets
> to the savefile without looking into them?

It could, in principle, be done...

...but it would pretty much mean incorporating the anonymization code in
tcpdpriv into Ethereal/Tethereal itself, and adding command-line options
in Tethereal and "Save As" dialog box options in Ethereal to control it;
I'm not sure that's the right way to do this.