Comment # 11
on bug 9234
from Jakub Zawadzki
(In reply to comment #10)
> In concept, I think something like this could work:
>
> tshark -r infile.pcap -A ip.host "/10.1.1.1/10.2.2.2/" -w outfile.pcap
>
> That would take the value in any container matching ip.host in infile.pcap,
> replace any occurrence of 10.1.1.1 with 10.2.2.2, then save the result to
> outfile.pcap. The idea would be to make it extensible to any container
> tshark can dissect, with the flexibility of sed.
I'd rather crate seperate binary so maybe - sedshark?
Anyway, can do. I hope you don't care about CRCs.
In 2011 I proposed syntax like:
editcap \
--change="ip.src="" && ip.dst==192.168.0.2 ==> ip.src=""
ip.dst=10.0.0.2, ip.checksum=NEW" \
--change="ip.src="" && ip.src="" ==> ip.src=""
ip.dst=10.0.0.1, ip.checksum=NEW"
Kuba.
You are receiving this mail because:
- You are watching all bug changes.