How to Anonymize a PCAP File Before You Share It

A capture is often the fastest way to show a vendor, a colleague or a bug tracker what went wrong. It is also a compact copy of your network: addresses, names, cookies, SIP URIs, and, in a mobile trace, subscriber identifiers. Before the file leaves your lab, those values have to be replaced consistently, not just deleted, or the capture stops being useful.

This article compares practical ways to sanitize a pcap or pcapng, the pitfalls that leave real data in the file, and a workflow with PCAP Workbench. Work only on a copy. Share a sanitized file only when you are authorized to do so.

What "consistent" sanitizing actually means

A useful sanitized capture still parses, still shows the same conversations, and no longer names real hosts or people:

• The same real value becomes the same fake value everywhere it appears, so a TCP stream, a DNS answer and an ARP entry still refer to one host.
• Shape is preserved. Payload lengths stay the same, so TCP sequence numbers and stream following keep working.
• Routing logic stays readable when you need it: hosts that shared a subnet should still share a (fake) subnet.
• Broadcast and multicast are left alone. Rewriting them would change what the packet means, not just who it names.

The tunnel pitfall

Many rewriters change only the addresses in the outer IP and Ethernet headers. That is not enough for tunneled traffic.

A GTP-U G-PDU (UDP port 2152) carries an inner IP packet — often the subscriber's UE address. VXLAN, GRE, GENEVE and IP-in-IP do the same at their inner layer. Application payloads add a second leak: a DNS query, an HTTP Host header, a SIP URI or a cookie can still hold a real name after every header IP has been replaced.

After any sanitizing pass, open the result and look at both the outer and the inner addresses, and at the application fields you care about. In Wireshark or tshark, open a tunneled packet and read the inner IP layer; do not assume a tool got every occurrence because the outer headers look fake.

Option 1: tcprewrite

tcprewrite (from Tcpreplay) can rewrite addresses offline and fix checksums with --fixcsum. A typical CIDR map looks like this:

tcprewrite --infile=in.pcap --outfile=lab.pcap --pnat=10.0.0.0/8:192.168.50.0/24 --fixcsum

--srcipmap and --dstipmap rewrite only one direction. --seed pseudo-randomizes IP addresses; --enet-mac-seed randomizes MAC addresses.

Good for: bulk outer IP/MAC rewrite before a lab replay.

Limits: it is an address rewriter, not a sanitizer for DNS names, HTTP cookies, SIP URIs, e-mail addresses or mobile identifiers. Inner addresses inside GTP-U and similar tunnels are easy to miss. Always verify the output.

Option 2: Scapy

Scapy can walk a capture in Python, replace the fields you name, and write a new file.

Good for: a scripted, reviewable mapping for a simple Ethernet/IP stack.

Limits: you own every layer and every application field. For GTP-U you must parse the G-PDU, rewrite the inner header, and then repair outer checksums and lengths. One forgotten layer is a leak.

Option 3: PCAP Workbench Anonymize / sanitize

A packet-aware tool can apply one mapping across the file and keep lengths valid. PCAP Workbench from Loosha Soft includes Anonymize / sanitize. According to the product page and User Guide, it:

• runs fully offline, with no cloud account and no license server;
• replaces IP addresses with a prefix-preserving mapping, or a sequential mapping into documentation addresses (192.0.2.x, 2001:db8::);
• consistently anonymizes MAC addresses, ports (ephemeral ports, not well-known service ports), DNS names (every label but the top-level one; A/AAAA answers follow the IP mapping), HTTP Host / cookies / credentials, SIP URIs, and e-mail addresses;
• can anonymize mobile IDs (IMSI / MSISDN / IMEI / TEID), keeping the MCC/MNC and the MSISDN country code;
• can write a mapping file so the next capture of the same case maps every host, name and identifier to the same fake value;
• leaves broadcast and multicast addresses unchanged, and keeps payload lengths so TCP sequence numbers stay valid.

Open the tool, keep MAC and IP anonymization on, tick the application and mobile options the capture actually contains, and optionally name a mapping file. The same step can be saved in a recipe and run later from the CLI:

LooshaPcapWorkbench.exe --run-recipe "anonymize lab" -i capture.pcapng -o clean.pcapng

(The recipe name is the one you saved. Community Edition writes at most the first 10 packets of each input; Full Edition has no packet-count limit.)

A practical sanitizing workflow

1. Copy the file. Never overwrite the original capture.
2. Decide what must leave. Addresses only, or also names, cookies, SIP URIs, e-mail and mobile identifiers.
3. Run one consistent mapping. In PCAP Workbench that is Anonymize / sanitize, with a mapping file if you will sanitize further captures from the same case.
4. Verify the result, not only the outer headers. Walk a GTP-U (or VXLAN, GRE, GENEVE) packet and read the inner IP addresses. Search for a known real hostname, a SIP user, or an IMSI you expected to be gone.
5. Share only the sanitized copy, and only with people who are allowed to see that trace.

If verification still shows an inner address or a payload string you meant to remove, treat the file as not ready to share.

Which tool when?

Editions

PCAP Workbench has a Community Edition with all features available for evaluation: it opens and analyses captures of any size, and operations that write a new capture use no more than the first 10 packets of each input. It is free for personal, educational and non-commercial use. The Full Edition is a one-time $59 license with no packet-count limit. The current release runs on Windows 10/11 64-bit without administrator rights, and a Linux build is available on request.

Explore PCAP Workbench →

Limitations

• Anonymizing a capture is not a legal clearance to share it. You remain responsible for what leaves your environment.
• Header-level tools — including generic address rewriters — may leave inner tunnel addresses and application payloads unchanged. Verify those layers every time.
• Community Edition applies the 10-packet write cap to Anonymize / sanitize, as to other capture-writing tools.

FAQ

Will prefix-preserving mapping keep two hosts in the same /24 together?
Yes. Hosts that shared a subnet still share a fake subnet. Sequential mapping instead uses documentation addresses.

Do broadcast and multicast addresses get replaced?
No. They are left alone, because remapping them would change the meaning of the packet.

If I sanitize a second capture from the same incident, will the hosts match the first file?
Yes, if you reuse the same mapping file. Without it, a new run can assign different fakes.

Does this need an internet connection?
No. PCAP Workbench runs fully offline, and Full Edition activation works with a license file.