Can Replay be disabled in Wireshark? I need a version of Wireshark or I need to modify Wireshark so that packets can not be replayed. Is this possible? If so, how? asked 06 Mar '12, 10:41 Balthazar2007 |
3 Answers:
Assuming you mean you want Wireshark to make a capture file non-replayable by a third party, I don't think there's a feature for that. If your pcap contains src and dst IPs, it can be replayed, so you simply need to anonymize your pcap to prevent replay to the actual endpoints (the anonymization rewrites the IPs). You can do that with a variety of packet-rewrite tools, including answered 06 Mar '12, 10:55 bstn |
I can think of two mechanisms to prevent replaying VoIP/VTC, filtering and slicing.
The best way to deal with this is to capture all traffic and make sure that only certain people are able to access the capture files. There will need to be trust in those people that the files will not be used for replaying. You can then discuss some procedures on how to access, filter and delete the data. answered 06 Mar '12, 12:11 SYN-bit ♦♦ |
Wireshark doesn't have a "replay" (send packets from a capture file to the network) capability. Please explain in a bit more detail what you are trying to disable. answered 06 Mar '12, 10:49 Bill Meier ♦♦ My system is used for corporate communications and the bosses are afraid that someone could use Wireshark to reconstruct VoIP calls or TeleConferences and actually replay the conversations. I need the wireshark to help in investigating intrusion attempts/events. Is there a middle ground where I can still view packets but not be able to reconstruct an actual phone call or VTC? (06 Mar '12, 11:32) Balthazar2007 |
Basically: If someone can capture (and save) all the bits, then (obviously) there's enough to be able to decipher a conversation (assuming no encryption).
Blog entry on VOIP encryption