How to Strip VLAN Tags and Decapsulate GTP-U in a Capture

Captures rarely arrive in the exact shape a tool or a device under test wants. The file may be raw IP or a Linux cooked dump from the any interface, it may carry one or two VLAN tags, or the interesting packet may sit inside a GTP-U tunnel. Changing the declared link type is not the same as converting the frames.

This article compares the practical options for converting link type, stripping VLAN tags, and unwrapping GTP-U, and a workflow with PCAP Workbench. Work on a copy. Replay the result only on an authorized lab interface.

Start with the link type

Every pcap declares a data-link type. Ethernet is link type 1 (DLT_EN10MB). Two other forms show up constantly in lab work:

• Raw IP (DLT_RAW): no Ethernet header, just an IPv4 or IPv6 packet.
• Linux cooked (SLL or SLL2): what tcpdump or Wireshark often records on the any interface.

Many replay and rewrite tools, including Send to network in PCAP Workbench and Mobile Core Generator, expect Ethernet. If you skip the conversion, the sender rejects the file or puts the wrong bytes on the wire.

Option 1: editcap — and what it will not do

editcap is excellent at file-level work: pcap ↔ pcapng (-F), packet ranges, timestamps, truncation. It can also set the output encapsulation with -T.

That last switch only changes the type stored in the file header. It does not add, remove or translate headers. The official manual is explicit: -T ether will not turn a raw-IP capture into Ethernet frames. For that you need a tool that writes a new Layer-2 header.

editcap can strip a single 802.1Q tag by chopping four bytes after the two MAC addresses, and adjusting the original length:

editcap -L -C 12:4 capture_vlan.pcapng capture_no_vlan.pcapng

This is an offset chop, not a protocol-aware VLAN editor. It is wrong for Q-in-Q (two tags, eight bytes), for a mix of tagged and untagged frames, and for anything that is not Ethernet. Use it only when you already know every frame has exactly one tag at offset 12.

Option 2: tcprewrite and Scapy

tcprewrite can translate link types with --dlt. Converting raw IP or Linux cooked to Ethernet requires you to supply the MAC addresses the source framing does not have:

tcprewrite --dlt=enet --infile=sll.pcap --outfile=eth.pcap --enet-smac=00:11:22:33:44:55 --enet-dmac=66:77:88:99:aa:bb

The other direction, --dlt=raw, strips Ethernet and writes a raw-IP capture. VLAN tags can be added or removed with --enet-vlan=add or del, and --enet-vlan-tag sets the ID when adding.

In Scapy, wrap an IP packet in Ethernet and write the file:

from scapy.all import Ether, wrpcap, rdpcap
pkts = rdpcap("raw.pcap")
out = [Ether(src="00:11:22:33:44:55", dst="66:77:88:99:aa:bb")/p for p in pkts]
wrpcap("eth.pcap", out)

Good for: scripted link-type conversion and simple VLAN add/remove.

Limits: a fixed rewrite does not parse GTP-U optional headers, and it will not repair inner and outer checksums after you unwrap a tunnel. Q-in-Q and mixed tagging still need care.

Option 3: PCAP Workbench VLAN tags and GTP-U tools

PCAP Workbench from Loosha Soft includes protocol-aware capture tools for these jobs. According to the product page and User Guide, it:

• opens PCAP and PCAPNG and keeps the input's format and link type on save, unless a tool changes it;
• VLAN tags: Insert a single 802.1Q tag, or a Q-in-Q (802.1ad) pair, or Strip tags with scope *All tags* or *Outer tag only*. Insert mode sets the tagging of the frame; it does not stack a new tag on top of whatever was already there. VLAN ID is 0–4094, priority (PCP) is 0–7;
• GTP-U: Encapsulate wraps an existing IPv4 or IPv6 packet as a GTPv1-U G-PDU (TS 29.281, UDP/2152) with a TEID and outer IPv4 addresses you give (defaults are documentation addresses); Decapsulate unwraps a G-PDU back to the inner packet, including a best-effort walk of optional GTP-U fields and extension headers;
• recalculates lengths and checksums across nested layers, including VXLAN, GRE, IP-in-IP, GTP-U, MPLS and GENEVE, with Fix All after an edit.

A related tool, L3 convert, is easy to misread: it translates IPv4 ↔ IPv6 using the 64:ff9b::/96 embedding (RFC 6052). It is not a link-type converter, and it skips fragmented IPv4 packets, IPv6 extension headers and ICMP.

There is no general "strip MPLS" or "strip VXLAN" tool in the published feature set. For those encapsulations, Workbench's strength is editing and repairing the inner and outer headers, not removing the tunnel in one click.

A practical conversion workflow

1. Copy the file and note the current link type (Wireshark's Statistics, or capinfos).
2. Convert to Ethernet first if you will replay or run a tool that requires link type 1. Use tcprewrite --dlt=enet (with MACs) or Scapy.
3. Strip or set VLAN tags with the VLAN tags tool when the DUT wants untagged frames, or a different ID. Prefer a protocol-aware editor over a fixed-offset chop if the file might contain Q-in-Q or mixed frames.
4. Decapsulate GTP-U when the next tool needs the inner IP packet rather than the G-PDU. Keep the original if you still need the outer tunnel for a later test.
5. Repair and validate. In Workbench, run Fix All, then open the result in Wireshark or tshark and check for malformed packets and bad checksums.
6. Replay only in the lab.

Which tool when?

Editions

PCAP Workbench has a Community Edition with all features available for evaluation: it opens and analyses captures of any size, and operations that write a new capture use no more than the first 10 packets of each input. It is free for personal, educational and non-commercial use. The Full Edition is a one-time $59 license with no packet-count limit. The current release runs on Windows 10/11 64-bit without administrator rights, and a Linux build is available on request.

Explore PCAP Workbench →

Limitations

• Send to network and several rewrite tools require Ethernet (link type 1). Convert first.
• L3 convert is IPv4 ↔ IPv6 only, with the skips listed above. ICMP is not a header-only conversion.
• GTP-U encapsulate builds a plain G-PDU without optional sequence, N-PDU or extension-header fields. Decapsulate still walks those fields when they are present in a captured tunnel.
• Do not use editcap -T as a converter.

FAQ

Can I turn a raw-IP pcap into Ethernet with editcap -T ether?
No. -T only rewrites the file header. Use tcprewrite --dlt=enet (and supply MACs) or wrap the packets in Scapy.

Does the VLAN tool add a second tag on top of an existing one?
No. Insert mode replaces the current tagging with the tag or Q-in-Q pair you set.

What happens to the Ethernet header when I decapsulate GTP-U?
The inner IPv4 or IPv6 packet becomes the payload of the same Ethernet frame (the outer UDP/GTP headers are removed). Non-GTP-U frames are copied unchanged.

Will Fix All strip an MPLS label stack?
No. It repairs lengths and checksums of the packet under the stack. Stripping MPLS is a separate, manual or scripted edit.