Editing a capture sounds trivial: open the file, change a byte, save. Then you replay it, and the device under test drops every packet, or Wireshark fills the screen with "bad checksum" and "malformed packet" warnings. The capture is structurally broken, and the edit itself was the cause.

This article explains why that happens and compares the practical ways to edit pcap and pcapng files so they stay valid.

Why a small edit breaks a packet

Network headers describe the data that follows them. Change the data and the description goes stale:

  • Length fields. IPv4 Total Length, IPv6 Payload Length, UDP Length and many application-level lengths (SIP Content-Length, GTP length, Diameter or RADIUS lengths) must match the real size. Add one character to a SIP URI and several of them are wrong at once.
  • Checksums. IPv4 header checksum, UDP/TCP checksums over a pseudo-header, SCTP CRC32c. Any change in the covered bytes invalidates them.
  • Nested layers. In tunneled traffic (GTP-U, VXLAN, GRE, IP-in-IP, MPLS, GENEVE) the same packet has an inner and an outer set of lengths and checksums. Fixing only one level still leaves a broken packet.
  • Stream state. Change the size of a TCP payload and every later sequence and acknowledgment number in that direction is off.
  • Encodings. Some protocols are not simple byte fields. NGAP and S1AP use ASN.1 APER, so a "small" change can alter the encoded length of everything around it.

Option 1: editcap and the Wireshark tools

editcap ships with Wireshark. It is excellent at file-level operations: selecting or removing packet ranges, splitting files, shifting timestamps, removing duplicates, truncating packets and converting between pcap and pcapng. mergecap combines files.

What editcap does not do is edit protocol fields. It also does not recalculate lengths and checksums after you change bytes yourself. Use it for slicing and timing, not for content.

Option 2: Scapy

Scapy reads a pcap, lets you change fields in Python and writes the result. The standard trick is to delete the length and checksum fields (del pkt[IP].len, del pkt[IP].chksum, del pkt[UDP].chksum) so that Scapy recomputes them when it rebuilds the packet.

Strengths: fully scriptable, free, flexible, great for repeatable transformations.

Limits: you must know which fields to reset at each layer, including inner layers of tunnels. TCP sequence numbers after a payload size change are your job, and application-level lengths such as SIP Content-Length are not covered by the trick. Large captures can be slow to process.

Option 3: tcprewrite and similar tools

tcprewrite (from Tcpreplay) can rewrite addresses and ports and fix checksums (--fixcsum). It is a good choice for bulk address rewriting before replay. It is not a field editor for arbitrary protocols.

Option 4: a packet-aware capture editor

The other approach is an editor that understands the protocol stack and updates dependent fields for you. PCAP Workbench from Loosha Soft is built for this. According to its product page, it:

  • opens PCAP and PCAPNG and lets you edit any field in the protocol tree or work directly with bytes;
  • recalculates lengths and checksums across nested layers, including VXLAN, GRE, IP-in-IP, GTP-U, MPLS, GENEVE, IPv6 extension headers and fragmented datagrams;
  • detects truncation, invalid lengths and bad checksums, and repairs every length and checksum with Fix All;
  • lets you edit TCP payloads while later sequence and acknowledgment numbers follow;
  • adds or removes TCP and IPv4 options, IPv6 extension headers, IEs and attributes;
  • edits NGAP/S1AP with APER re-encoding and SCTP chunks with CRC32c;
  • inspects and edits TLS ClientHello, QUIC Initial (decrypt, edit, re-encrypt) and HTTP/2 headers;
  • lets you change a SIP Call-ID, URI or tag, or a GTP TEID once and apply it to the whole call or tunnel, with SIP Content-Length and lower-layer values following the edit.

Around editing it also offers byte-by-byte capture comparison, Wireshark-style filters, timestamp shifting, merging, reusable recipes, consistent anonymization (prefix-preserving IP mapping, MACs, ports, DNS names, credentials, SIP URIs and more) and replay to a lab interface (loopback by default). Everything runs offline, with no cloud account and no license server.

A safe editing workflow

  1. Work on a copy. Keep the original capture untouched.
  2. Check the file first. Find existing bad checksums or truncation before you edit, so you don't blame your edit for problems the file already had. (Many captures taken on the sending host show bad checksums because of checksum offload.)
  3. Make the edit at the right level. Change a field when you mean a field, use a call-wide or tunnel-wide change for identifiers like Call-ID or TEID, and edit bytes only as a last resort.
  4. Repair dependent values. In PCAP Workbench that is Fix All. In Scapy, reset the length and checksum fields on every layer you touched.
  5. Validate. Open the result in Wireshark or tshark and filter for checksum or malformed warnings, or compare the original and edited captures byte by byte.
  6. Replay to a lab interface only. Never replay edited traffic onto a production network.

Which tool when?

Task Good fit
Cut, split, merge, shift time, convert format editcap / mergecap
Scripted field changes in simple stacks Scapy
Bulk IP/port rewrite before replay tcprewrite
Field edits in tunnels, SIP, TCP payloads, NGAP/S1AP, SCTP with automatic repair PCAP Workbench

Editions

PCAP Workbench has a Community Edition with all features available for evaluation: it opens and analyses captures of any size, and operations that write a new capture use no more than the first 10 packets of each input. It is free for personal, educational and non-commercial use. The Full Edition is a one-time $59 license with no packet-count limit. The current release runs on Windows 10/11 64-bit without administrator rights, and a Linux build is available on request.

Explore PCAP Workbench →

FAQ

Why does Wireshark show bad checksums on a capture I didn't edit? Often because of checksum offload on the capturing host: the NIC fills checksums after the capture point. Wireshark validation for these fields is frequently disabled by default for this reason.

Can editcap change an IP address? No. editcap works with whole packets and files. Use Scapy, tcprewrite or a packet editor for field changes.

If I change a TCP payload size, will the stream still work? Only if the later sequence and acknowledgment numbers are adjusted. PCAP Workbench does this automatically. In Scapy you have to do it yourself.

Does PCAP Workbench need an internet connection? No. It runs fully offline, and Full Edition activation works with a license file.