Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

What would be an easy way to replace a sensitive IP address in a Wireshark packet capture with XXX.XXX.XXX.XXX? When I export the pcap in txt or csv I can no longer import it into Wireshark.

share|improve this question

1 Answer 1

When running a Linux box, you could perform a

sed -i 's/10.10./XX.XX./g' <file name> 

where 10.10. are the first two octets of your IP address and is the name of the capture log.

Under Windows you could run an advanced editor and use the search and replace feature.

share|improve this answer
    
this seems to corrupt the capture. I can only see about 700 out of the 1500+ lines in my capture after running this. Any ideas? –  jmort253 Aug 20 '12 at 16:48
    
Does your package capture file contain any binary data? If yes, try strings <filename> |sed -i 's/10.10./XX.XX./g' - –  Valentin Aug 20 '12 at 17:27

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.