Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] How to replace IP addresses in a trace file?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 22 Sep 2006 17:24:46 -0700

On Sep 22, 2006, at 12:27 PM, P Li wrote:

Hello, I want to use a trace file in a demo. Is it possible to
manipulate part of the IP addresses without changing other information
(timestamp, flags etc.). For instance, how can I change all the IP
addresses 10.1.x.x to 192.168.x.x in a trace file? It seems Editcap
can not do this. Any tools?

If the trace files are in libpcap format (the standard format for Wireshark), you might be able to use some of the Internet Traffic Archive tools:

	http://ita.ee.lbl.gov/html/software.html

or modify those tools to do what you want. (tcpdpriv is oriented towards hiding network information; I don't see any obvious indication of a way to get it to do *particular* mappings of IPv4 addresses, so you might have to modify it to add such an option.)