Wireshark-bugs: [Wireshark-bugs] [Bug 9234] Modify value in a protocol container
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 11 Nov 2013 15:02:03 +0000

changed bug 9234

What Removed Added
Attachment #12057 Flags   review_for_checkin-

Comment # 12 on bug 9234 from 
Created attachment 12057 [details]
Modify option for tshark (PoC)

Lazy me I put this into tshark.

It can only edit IPv4 addresses, syntax is like (comment #11), 
it's not trivial to edit ip.host so you must write seperate rule for ip.src and
ip.dst.

Like:

tshark -r foo.pcap -w foo-changed.pcap \
    -M 'ip.src == 10.1.1.1 ==> ip.src="" \
    -M 'ip.dst == 10.1.1.1 ==> ip.dst=10.2.2.2'

hope it works for you. If it doesn't work or you want some more features,
feel free to bug me ;-)

You are receiving this mail because:
  • You are watching all bug changes.