I have a pcap file which has multiple IP addresses, I want to replace those multiple IP addresses with single address, is there any command to do so? asked 04 Mar '14, 02:20  shubhangi edited 04 Mar '14, 02:32  grahamb ♦ |
One Answer:
Why do you want to replace all IP addresses with a single address? That would lead to a file with the IP talking to itself, which is not seen on networks and doesn't make any sense (except for localhost stuff, but you don't see that in a pcap usually). If you want to replace IP addresses you can use tcprewrite, bittwiste or TraceWrangler. answered 04 Mar '14, 02:42  Jasper ♦♦ |
sorry, I mean I want to replace multiple SOURCE IP addresses with a single SOURCE IP address using tcprewrite, can you help me out?
Hm.. that can lead to 'collisions' if different clients (different IPs) are using the same source port to one destination address. The resulting capture file will be useless, as you cannot distinguish the former differing streams.
So, why do you want to do that?
Not to mention most protocols are bi-directional, so you'd change from this:
A->B B->A A->B B->A
To this:
C->B B->A C->B B->A
(or C->A and C->B depending on whether all source addresses are changed or not)
Kinda silly. :)