This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I want to alter the xml/pdml file, and then reloaded it in wireshark and resave it as a pcap file. Is this at all possible?

asked 08 Jul '11, 07:11

ROCKSTARARTIST's gravatar image

ROCKSTARARTIST
1111
accept rate: 0%


I don't think it is possible with the Wireshark tools, but I might be mistaken.

But if you're trying to alter an xml/pdml file just to modify a pcap trace that you already have I would recommend avoiding the export to text and reimporting it - instead, I'd go for tools that can modify pcaps directly. I've shown a couple of tools in my talk on Sharkfest this year, so you can look the presentation (A-11) up in the review section here: http://sharkfest.wireshark.org/sharkfest.11/index.html

If you're trying to modify layers beyond the transport layer those tools won't help you though; in that case you're probably going to have to edit them with a hex/text editor.

permanent link

answered 08 Jul '11, 08:11

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 08 Jul '11, 08:13

Thank you for your answer and in linking an informative presentation. Unfortunately I am trying to modify layers beyond TCP/IP, and the majority of the tools that I have found do not assist me in that regard, and I am trying to avoid the hex/text editor approach. I am taking at look at SCAPY, which is a python PCAP editor that allows you to describe your own layers... we will see how that goes.

(08 Jul '11, 09:04) ROCKSTARARTIST

Besides scapy, you might also want to look into netexpect and packetfu. Packetfu was just presented at Sharkfest '11 by Tod Beardsley of the Metasploit project. Tod's presentation is listed as the "A-3 PacketFu by Example" presentation at the Sharkfest '11 retrospective page that Jasper referenced above.

(10 Jul '11, 17:06) cmaynard ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×15

question asked: 08 Jul '11, 07:11

question was seen: 4,434 times

last updated: 10 Jul '11, 17:06

p​o​w​e​r​e​d by O​S​Q​A