Capture Sanitisation

[Ivan <wireshark () itpro co nz>]

Hi,

Just joined the mailing list so to start of would like to congratulate 
all involved on contributing to a superb product.

I have been a long time user but recently more so than normal.  I have 
found very often that functionality to sanitise captured data would be 
extremely helpful.  Understandingly many prefer that captures provided 
to 3rd parties don't contain excessive or confidential data or network 
information.

Searches of the mailing lists and general Internet have not shown me any 
existing functionality within Wireshark.

If such a feature is not implemented I would like to add to the wishlist 
(http://wiki.wireshark.org/WishList) but as per instructions am posting 
here first.

In order of preference I would like the ability to

1) Remove TCP or UDP payload retaining the header (truncate captured 
packets at the end of the TCP or UDP header).  Obviously this could be 
done for other protocols too but TCP and UDP would be a good start.

2) As a later and advanced step if protocol definitions indicated 
headers and payload allow removal of payload within more protocols.  For 
example the http headers could be retained while removing the actual 
http data.

2) Be able to randomly substitute IP addresses within the captures 
consistently so that analysis is still valid but actual addresses are 
kept private.  Header checksums should be recalculated.

I am not sure if this functionality would belong in one of the command 
line tools, Wireshark or both.

Some non Wireshark solutions that may be worth referencing
Sanitize - http://ita.ee.lbl.gov/html/contrib/sanitize.html
Bit-Twist - http://bittwist.sourceforge.net/

Thanks

Ivan
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe