3

I have several PCAP files which contain network traffic. To perform some experiments for a network experiment, I need real data with completely randomized IP addresses.

I am well aware about the possibilities of tcprewrite, which can be used with the seed parameter like this:

tcprewrite --seed=423 --infile=input.pcap --outfile=output.pcap

According to the document, the sessions between hosts is maintained when using this method. This however does not provide enough randomness for me based on the available dataset. As an example assume a large PCAP file with many packets, which however only contains the traffic between two hosts. Randomizing this trace with the method mentioned above simply replaces both IP addresses with another two. There are still two addresses in total.

I would like to change the IP addresses completely independent from the original IP to be uniformly distributed either among all available IP space or within a given prefix.

As an example, I would like to change all destination addresses in a PCAP file to be uniformly and randomly distributed within the range 10.0.0.0/8, without maintaining the original mapping.

Hence the question is: How to completely randomize IP addresses in a PCAP file?

Ideally I would like to specify the IP range in which the addresses are randomized, so basically: How to set all destination addresses to a random address from the range 10.0.0.0/8?

Improve this question
2
  • You build the entire question on the sentiment "not enough randomness for me", yet leave it completely undefined. What is the technical weakness you spot? Why is the in-box solution not good enough due to it? What would in technical terms constitute "enough randomness for you"? Or is it exclusively a matter of defining a range?
    – ErikE
    Aug 9, 2015 at 22:50
  • @ErikE: thank you for response, I have added some details.
    – Daniel
    Aug 9, 2015 at 23:06

1 Answer 1

Reset to default
2

The Wireshark Wiki lists many options to investigate.

These tools can be used to "anonymize" capture files, replacing fields such as IP addresses with randomized values.

  • AnonTool from the CRAWDAD archive of wireless traffic.
  • The bittwiste tool from Bit-Twist.
  • The Crypto-PAn tool.
  • The Network Expect tool, which can be used to anonymize packets.
  • The pktanon tool from the Karlsruhe Institute of Technology Institute of Telematics.
  • The SCRUB-tcpdump tool.
  • The tcpdpriv tool from the Internet Traffic Archive.
  • The tcprewrite tool from tcpreplay.
  • The TraceWrangler tool.

Additionally, a quick google search turned up sanicap on github.

Improve this answer
1
  • Thank you very much. The SCRUB-tcpdump tool does what I need, however, it is not documented. While the "ra" option should map all encounters of one IP in the source file to one IP in the destination file, it actually does not do this, which comes quite handy for me. Otherwise, your final tip sanicap is a good starting point to write this quickly in python. Sorry I cannot upvote yet.
    – Daniel
    Aug 10, 2015 at 8:21

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .