In my network troubleshooting work, I’ve received many trace files that contained more information than the customer was aware of and wouldn't be too happy about them being shared.

for testing, I am able to replay pcap files from wireshark using playcap, but I'd like to automate this testing and execute specific files and then test the results for what is expected behaviour. Please keep in mind that you should only share real corporate packets that you are familiar with and with vendors you trust. 1 I've got software that listens for SNMP Traps and performs certain functions on receiving them.

I am surprised that Wireshark doesn’t have a more comprehensive packet edit tool, but happy it's making headway.Īs I mention in the video, there are some tools out there that will change the MAC address or IP address in all your packets like TraceWrangler, which I have used for a while. This editing technique doesn’t scale well or isn’t practical if you need to modify 1,000 packets, but I still find it helpful and hope the Wireshark development team continues to build on this cool feature. In short, after making sure that the prerequisite software is installed, the following commands will get the code and build videoreplay. In this video, I change a CDP device ID and CDP’s checksum.

You can edit anything in the packet at any layer. There are many situations where you wish you could share a trace file with a vendor, but you can’t because the packets may contain sensitive data such as corporate identifying information, IP addresses, and passwords.īut now, Wireshark, the open source network analysis tool, has an experimental feature under Edit->Preferences called Enable Packet Editor which does exactly what is says.

Replay pcap wireshark