I did about anonymizing network packet trace files at Sharkfest 2013. You can also take a look at my presentation My GPG public key can be found here Documentation Documentation is available online, as well as a Windows help file inside the download container. Also, the documentation isn't up to date. Those builds are usually working better than the latest stable release,īut in some cases features may not be implemented completely yet, or still broken. There is also a semi-automated build section where you can download current builds. extracting conversations from multiple files to new capture files, based on manual filters, capture file indicator frames, or Snort alertsģ2bit version: TraceWrangler Beta 0.6.8 build 949 (GPG Signature: ).Displaying the PCAPng specific block structure of a file.Gathering and aggregating packet details about a large number of capture files, like IP, TCP and UDP conversations.Merging capture files, especially PCAPng files with more than one interface and using filters to keep only certain frames.Editing packets in batch, especially by removing certain protocol layers like MPLS, GRE or GTP-u, or to convert Linux cooked captures to Pseudo-Ethernet.Sanitization/Anonymization/Scrubbing of packet captures created by Wireshark/TCPDump/etc.

utility to read, write and modifiy PCAPng files.Sanitization and anonymization of PCAP and PCAPng files (sometimes called 'trace files', 'capture files' or 'packet captures'), removing or replacing sensitive data The most prominent use case for TraceWrangler is the easy PCAPng file format, which is now the standard file format used by Wireshark. TraceWrangler is a network capture file toolkit running on Windows (or on Linux, using WINE) that supports PCAP as well as the new

TraceWrangler - Packet Capture Toolkit TraceWrangler - Packet Capture Toolkit Introduction

Online wireshark pcap viewer