Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Is it possible to remove/change packages captured with Wireshark?

My Situation: I captured some packages and want to send them to somebody else. The problem is, that one of the packages contains username and password. I don't want to send the password to somebody else. It would be nice if I could replace the password with another one.

I could use a hex editor to override the bytes in the file, but is there a way that is more simple?

share|improve this question

migrated from stackoverflow.com Dec 10 '12 at 18:47

This question came from our site for professional and enthusiast programmers.

    
I captured a handshake of a protocol. I want to show it to students for educational purpose, but I don't want them to see my private data. I don't understand what you mean? –  Fox32 Dec 10 '12 at 19:04

2 Answers 2

up vote 2 down vote accepted

No, I'm afraid that no algorithm could know what is personal and what is not in your packet capture.

personally i would create a capture of a safe handshake that does not expose any data you really care about. perhaps create a throw-away set of credentials to use just for that purpose. otherwise, you have to edit the capture itself as you have suggested. if you know the encoding type, it should be reasonably easy to identify the hex for your personal data.

share|improve this answer
    
I hoped I could click on a value in the tree view and change it to something else, but there isn't such a feature. –  Fox32 Dec 10 '12 at 19:27

A simple way to remove password from Wireshark trace is too remove the packet that contains it. Most of the time, a human will be looking at the trace, not a computer, so you can just tell them that a few packets are missing. If they absolutely need that packet, you can copy it as text, and send an edited version.

Here is how you remove the packet containing the password :

  1. Apply a display filter to reduce noise, if needed. For example, I used ldap in the Filter box.
  2. Identify the packet wich contains the password. You will need the frame number.
  3. Replace the display filter with !(frame.number == 6143). Replace 6143 with your frame number.
  4. In the "File" menu, select "Export Specified Packets..."
  5. In the "Packet range" section, select "All" and "Displayed"
  6. Save the capture file under a new name.

Caveats :

  • You have to remember to use the password-less file if the other person says "look at frame 7000", because the number will not perfectly line up.
  • There might be more than one password, it is up to you to find and remove them.
  • It will somewhat confuse Wireshark parsing, maybe because there will be missing tcp sequence number.
  • It could confuse a human to see a valid authentication response out of the blue.

enter image description here

share|improve this answer
    
Thanks for the awnser! In this case removing packages was not suiteable as the authentication was an important part of the capture. But it might be a help for others! –  Fox32 Mar 13 at 16:54

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.