This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

text2Pcap :- add/modify ip address. by default it keeps dummy header/existing ip address.

0

Hello, How can we add/modify ip address of pcap that is generated by text2pcap? which switch/parameter to use ?

asked 10 Sep '13, 22:32

cbhatt's gravatar image

cbhatt
11●1●1●2
accept rate: 0%

One Answer:

2

I'm not sure I understand your question correctly, but if you have a text file that you convert to pcap you can just edit the text file before converting it. If you already have the pcap file and want to modify an IP you can use trace editing tools like bittwiste, tcprewrite or TraceWrangler.

"Adding" an IP address is most likely not an option, unless you have a very specific (and realistic) place in the frame for this kind of thing.

answered 11 Sep '13, 03:30

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

In other words, the IP addresses that text2pcap puts in (when you use -i) aren't configurable. If you want to specify the IP addresses, don't use -i but rather build a complete packet yourself (so you can specify the IP addresses yourself).

(11 Sep '13, 06:04) JeffMorriss ♦

replace the following bytes in the text2pcap binary with a Hex editor.

45 00 00 00 12 34 00 00 FF 00 00 00 0A 01 01 01 0A 02 02 02 00

Src: 192.168.1.1
Dst: 192.168.2.2

would be:

45 00 00 00 12 34 00 00 FF 00 00 00 C0 A8 01 01 C0 A8 02 02 00

:-))

(11 Sep '13, 09:39) Kurt Knochner ♦

You can prepend a dummy IP header using text2pcap's "-i <proto>" option. See IANA's Protocol Numbers page for the complete list of assigned internet protocol numbers.

(11 Sep '13, 10:20) cmaynard ♦♦