This is a static archive of our old Q&A Site. Please post any new questions and answers at

Replace specific MAC using tcp-rewrite


I'm trying to replace a specific MAC address in a pcap using tcp-rewrite and can't figure out how to do it. It looks like it replace ALL the macs when I use the -enet-dmac command (or -enet-smac). I want to substitute one specific MAC with another specific MAC.

asked 12 Sep '17, 00:07

kdani's gravatar image

accept rate: 0%

Arguably, questions about tcprewrite are off topic for this site although there are a number of folks around that can help or suggest alternative approaches so I'll let these slide for now.

(12 Sep '17, 04:37) grahamb ♦

One Answer:


If you don't have the requirement of using tcprewrite it may be easier to do that with TraceWrangler. It requires Windows or running it using WINE on Linux.

answered 12 Sep '17, 01:11

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

thanks, it is possible solution - I managed to do it using another tool:

(12 Sep '17, 05:09) kdani