Search code examples
wiresharkpcap

How can I strip n bytes from each packet in a packet capture?


I have a number of packet captures in pcap format. Each packet contains a message for which I have dissector however each packet has 4 bytes prepended to it. This means the dissector will not understand the format.

Is there anyway for me to mangle these captures such that they come out the other end with those 4 bytes stripped off?


Solution

  • You will need to edit at least one dissector to do what you want. The best thing to do is to write a dissector that will handle the header inserted by your B protocol, against which the C protocol dissector would need to register. This gives you the added benefit of being able to examine information in the header of the B protocol and filter on its fields.

    However, if you really don't want to do that, you could modify either the A protocol or C protocol dissector to ignore those four bytes: in A, you would not include those bytes in the tvb given to C; or in C you would skip the first four bytes in the tvb.