Wireshark-users: Re: [Wireshark-users] How to replace IP addresses in a trace file?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 22 Sep 2006 17:24:46 -0700

On Sep 22, 2006, at 12:27 PM, P Li wrote:


Hello, I want to use a trace file in a demo. Is it possible to
manipulate part of the IP addresses without changing other information
(timestamp, flags etc.). For instance, how can I change all the IP
addresses 10.1.x.x to 192.168.x.x in a trace file? It seems Editcap
can not do this. Any tools?
If the trace files are in libpcap format (the standard format for Wireshark), you might be able to use some of the Internet Traffic Archive tools: 

	http://ita.ee.lbl.gov/html/software.html
or modify those tools to do what you want. (tcpdpriv is oriented towards hiding network information; I don't see any obvious indication of a way to get it to do *particular* mappings of IPv4 addresses, so you might have to modify it to add such an option.)