[Guy Harris <guy@xxxxxxxxxx>]

> I might suggest that having an indicator in the packet saying that it was
> modified would also be useful - for sanitized captures - to make it clear
> that "This packet is not original" - which would allow you to have a visible
> explanation for why a checksum wasn't correct, or why a conversation didn't
> show up right, etc.

Good idea; I'm forwarding it as an addition to the list of goals.

("Sanitized captures" here presumably refers to captures that have, say,
had passwords and other sensitive data replaced by zeroes or random data
or something such as that; it might also be useful to record that
packets have been *deleted* as a result of sanitizing the capture.)