A simple way to remove password from Wireshark trace is too remove the packet that contains it. Most of the time, a human will be looking at the trace, not a computer, so you can just tell them that a few packets are missing. If they absolutely need that packet, you can copy it as text, and send an edited version.
Here is how you remove the packet containing the password :
- Apply a display filter to reduce noise, if needed. For example, I used
ldap in the Filter box.
- Identify the packet wich contains the password. You will need the frame number.
- Replace the display filter with
!(frame.number == 6143). Replace
6143 with your frame number.
- In the "File" menu, select "Export Specified Packets..."
- In the "Packet range" section, select "All" and "Displayed"
- Save the capture file under a new name.
- You have to remember to use the password-less file if the other person says "look at frame 7000", because the number will not perfectly line up.
- There might be more than one password, it is up to you to find and remove them.
- It will somewhat confuse Wireshark parsing, maybe because there will be missing tcp sequence number.
- It could confuse a human to see a valid authentication response out of the blue.