topic Re: PCAP in General Topics https://live.paloaltonetworks.com/t5/general-topics/pcap/m-p/23884#M17398 <HTML><HEAD></HEAD><BODY><P>tcprewrite from the tcpreplay package can be used to modify the headers (and save into a new pcap) but it doesnt seem to support modifying payload.</P><P></P><P>Also modifying payload can be tricky since many protocols uses various methods of "encryption" (or rather encoding) - but sure to replace a string with another string "should" be easy (as long as you know the limitations of this) - however I didnt found any good rewriter of the payload stuff yet.</P><P></P><P><SPAN>Edit: Some good examples regarding tcprewrite: </SPAN><A class="jive-link-external-small" href="http://chrissanders.org/2010/12/sanitizing-pcap-files-for-public-distrubution/">http://chrissanders.org/2010/12/sanitizing-pcap-files-for-public-distrubution/</A></P></BODY></HTML> Wed, 11 Jan 2012 19:42:22 GMT mikand 2012-01-11T19:42:22Z PCAP https://live.paloaltonetworks.com/t5/general-topics/pcap/m-p/23883#M17397 <HTML><HEAD></HEAD><BODY><P>Does anyone know of a tool/application I can use to sanitize or remove username/password in a pcap file?</P></BODY></HTML> Wed, 11 Jan 2012 15:10:53 GMT https://live.paloaltonetworks.com/t5/general-topics/pcap/m-p/23883#M17397 friento 2012-01-11T15:10:53Z Re: PCAP https://live.paloaltonetworks.com/t5/general-topics/pcap/m-p/23884#M17398 <HTML><HEAD></HEAD><BODY><P>tcprewrite from the tcpreplay package can be used to modify the headers (and save into a new pcap) but it doesnt seem to support modifying payload.</P><P></P><P>Also modifying payload can be tricky since many protocols uses various methods of "encryption" (or rather encoding) - but sure to replace a string with another string "should" be easy (as long as you know the limitations of this) - however I didnt found any good rewriter of the payload stuff yet.</P><P></P><P><SPAN>Edit: Some good examples regarding tcprewrite: </SPAN><A class="jive-link-external-small" href="http://chrissanders.org/2010/12/sanitizing-pcap-files-for-public-distrubution/">http://chrissanders.org/2010/12/sanitizing-pcap-files-for-public-distrubution/</A></P></BODY></HTML> Wed, 11 Jan 2012 19:42:22 GMT https://live.paloaltonetworks.com/t5/general-topics/pcap/m-p/23884#M17398 mikand 2012-01-11T19:42:22Z