{"id":16865397,"url":"https://github.com/pocc/regexcap","last_synced_at":"2025-03-18T20:45:01.528Z","repository":{"id":57460860,"uuid":"252604178","full_name":"pocc/regexcap","owner":"pocc","description":"Replace bytes in a Wireshark field with a regex","archived":false,"fork":false,"pushed_at":"2020-04-21T23:25:26.000Z","size":57,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2025-01-24T23:16:47.633Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/pocc.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-03T01:29:40.000Z","updated_at":"2020-04-10T19:53:36.000Z","dependencies_parsed_at":"2022-09-17T04:00:28.735Z","dependency_job_id":null,"html_url":"https://github.com/pocc/regexcap","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pocc%2Fregexcap","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pocc%2Fregexcap/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pocc%2Fregexcap/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/pocc%2Fregexcap/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/pocc","download_url":"https://codeload.github.com/pocc/regexcap/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244306042,"owners_count":20431736,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-13T14:46:56.728Z","updated_at":"2025-03-18T20:45:01.506Z","avatar_url":"https://github.com/pocc.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# RegexCap\n\nReplace packet fields with a regex and display filter.\nThis is useful for removing personally sensitive information by field.\n[TraceWrangler](https://www.tracewrangler.com/) also performs this function,\nbut is limited to a Windows GUI and has a limited set of editable fields.\n\n## Installation\n\nYou can install from [regexcap@PyPI](https://pypi.org/project/RegexCap/0.0/) with pip.\n\n```bash\npip install regexcap\n```\n\nAlternatively, you can install by cloning it and installing it with pip.\n\n```\ngit clone https://github.com/pocc/regexcap\ncd regexcap\npip install .\n```\n\n## Command Line Options\n\n```bash\n$ regexcap --help\nusage: regexcap [-h] -r R -w W -e E [-s S] -d D [-Y Y] [-m] [-p]\n\nReplace pcap fields with regex\n\noptional arguments:\n  -h, --help  show this help message and exit\n  -r R        input file. Use - for stdin\n  -w W        output file. Use - for stdout\n  -e E        field to change. Multiple fields can be specified like `-e ip.src -e ip.dst`. Replacements will occur on all specified fields. If `frame` is specified, matching frameswill be replaced in their entirety.\n  -s S        source field bytes regex. Defaults to regex \".*\" if no arg is provided.\n  -d D        destination field bytes\n  -Y Y        Before replacing bytes, delete packets that do not match this display filter\n  -m          Speed up execution with multiprocessing by using one process per cpu.Output is always pcapng. If source file is a pcapng, then header data will be rewritten recognizing mergecap as the most recent packet writer.\n  -p          Use scapy for packet processing. Currently 50% slower and always saves to pcap.\n```\n\n## Usage notes\n\n* This replaces bytes in packets, not in packet or pcap headers. Those fields are not accessible to tshark.\n* Options `-r`, `-w`, `-e`, and `-Y` are copied from tshark for sake of familiarity\n* Whil the default is to not modify pcap/packet header data, multiprocessing (`-m`) modifies and\n  scapy-processing (`-p`) drops this data.\n* `-m` uses multiprocessing and will speed up execution for large files\n* `-Y` and `-m` create temporary files that are deleted on exit\n* Avoid shorthand display filters like `-e ip.addr` and use their more explicit\n  representations like `-e ip.src -e ip.dst`. Tshark maps shorthand\n  display filters to exactly one field in json output, so fewer fields may be\n  replaced than expected.\n* Currently set to error if there is a length mismatch between old and new values.\n* This program will be slow! It uses python with a naive algorithm (i.e. it works)\n\n## Example Usage\n\n### Example 1: Replace MAC address NIC bytes\n\nFor example to replace the NIC-specific (last 6 bytes) part of all mac addresses:\n\n```bash\n$ tshark -r new.pcap -c 1\n    1 6c:96:cf:d8:7f:e7 → cc:65:ad:da:39:70 108.233.248.45 → 157.245.238.3 ...\n$ regexcap -r old.pcap -w new.pcap -e eth.src -e eth.dst -s '.{6}$' -d 000000\n$ tshark -r new.pcap -c 1\n    1 6c:96:cf:00:00:00 → cc:65:ad:00:00:00 108.233.248.45 → 157.245.238.3 ...\n```\n\n* `.{6}`: Take exactly six bytes of any type\n* `$`: This regex ends at the end of the field\n\n### Example 2: Replace private IP addresses\n\nTo replace all private IP addresses with quad 0's, use a byte regex like so:\n\n```bash\n$ tshark -r new.pcap -c 1\n    1   0.000000 192.168.1.246 → 217.221.186.35 TCP  54 59793 → https(443) [ACK] Seq=1 Ack=1 Win=2048 Len=0\n$ regexcap -r old.pcap -w new.pcap -d '^(?:0a..|ac1.|c0a8).{4}' -s '00000000' -e ip.addr\n$ tshark -r new.pcap -c 1\n    1   0.000000      0.0.0.0 → 217.221.186.35 TCP  54 59793 → https(443) [ACK] Seq=1 Ack=1 Win=2048 Len=0\n```\n\nBreaking down the regex, an IP address is 32 bits =\u003e 8 nibbles (hexadecimal characters).\nThe network bits of each of the private subnets determines how many nibbles each requires.\nIn other words /8 =\u003e 2 network chars, /12 =\u003e 3 network chars, /16 =\u003e 4 network chars.\n\n* `^`: regex starts at beginning of field\n* `(?:`...`)`:\n* `10.0.0.0/8 =====\u003e 0x0a + ......`\n* `172.16.0.0/12 ==\u003e 0xac1 + .....`\n* `192.168.0.0/16 =\u003e 0xc0a8 + ....`\n* `.{4}` summarizes the last 4 nibbles that are shared\n\nTo convert any IP address octet from decimal to hex, you can use the python built-in:\n\n```python\n\u003e\u003e\u003e hex(172)\n'0xac'\n```\n\n## Testing\n\nRun `tests/run_tests` or `pytest -vvv -x` from the root dir.\n\n## License\n\nApache 2.0\n\n\n## Contact\n\nRoss Jacobs, author, rj\\[AT\\]swit.sh\nhttps://github.com/pocc/regexcap\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpocc%2Fregexcap","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpocc%2Fregexcap","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpocc%2Fregexcap/lists"}