Wireshark-users: Re: [Wireshark-users] How to replace IP addresses in a trace file?
From: Guy Harris <[email protected]>
Date: Fri, 22 Sep 2006 17:24:46 -0700
On Sep 22, 2006, at 12:27 PM, P Li wrote:

Hello, I want to use a trace file in a demo. Is it possible to
manipulate part of the IP addresses without changing other information
(timestamp, flags etc.). For instance, how can I change all the IP
addresses 10.1.x.x to 192.168.x.x in a trace file? It seems Editcap
can not do this. Any tools?
If the trace files are in libpcap format (the standard format for  
Wireshark), you might be able to use some of the Internet Traffic  
Archive tools:
	http://ita.ee.lbl.gov/html/software.html

or modify those tools to do what you want. (tcpdpriv is oriented towards hiding network information; I don't see any obvious indication of a way to get it to do *particular* mappings of IPv4 addresses, so you might have to modify it to add such an option.)