On Sep 22, 2006, at 12:27 PM, P Li wrote:
> Hello, I want to use a trace file in a demo. Is it possible to
> manipulate part of the IP addresses without changing other information
> (timestamp, flags etc.). For instance, how can I change all the IP
> addresses 10.1.x.x to 192.168.x.x in a trace file? It seems Editcap
> can not do this. Any tools?
If the trace files are in libpcap format (the standard format for
Wireshark), you might be able to use some of the Internet Traffic
Archive tools:
http://ita.ee.lbl.gov/html/software.html
or modify those tools to do what you want. (tcpdpriv is oriented
towards hiding network information; I don't see any obvious indication
of a way to get it to do *particular* mappings of IPv4 addresses, so
you might have to modify it to add such an option.)
_______________________________________________
Wireshark-users mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-users
