Wireshark-users: Re: [Wireshark-users] How to edit a specific byte in a pcap file ?

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Fri, 26 Feb 2010 19:24:09 +0100
Hi,

Sounds you could use a true hex editor. You'll have to target the byte by hand, but you seem to know what you're looking for.

Thanks,
Jaap

Shashank Agarwal wrote:
Hi,
How can I modify a specific byte using WireShark or any of its tools. I tried bit-twiste, tcprewrite, tcpreplay-edit, but to no avail. These tools provide predefined and limited editing capability like editing the IP address or TCP port or changing timestamp etc.
E.g. I have the hex bytes from an ethernet broadcast packet -
ff  ff  ff  ff  ff  ff  00  0b  20  40  15  6d  19  02  40 ......
First six bytes is dest. address, next 6 bytes is source address, "19 02" is packet type and the 15th byte (0x40) contains a flag. I want to turn on the second bit in this 15th byte. Essentially replacing 0x40 with 0x42.
Which tool can help me with this modification in the pcap file?
Thanks