Wireshark - programatically modify packets from pcap file

Question

I have a series of packets in a pcap file with various protocols, such as GTPV2,S1AP,Diameter etc etc. I need to know if there's a way to modify some fields programatically, for instance:

for the GTPV2 protocol : MCC field - Mobile Country Code, MNC field - Mobile Network Code for the S1AP protocol: Protocolie-Field etc etc

I managed to get the proto_tree and modify the tvbuff contents by specifically addressing the offsets of the buffer I am interested in, but can I say something like :

e212.mcc = "something"

where e212.mccc is a Wireshark filter? I am asking if this can be done in any language, but my guess is that the dissectors are only there for displaying, not modifying and I do not have an API to directly access the fields of the packet via a Wireshark filter. If this is so, do you know of any opensource tool which can modify the packets from a pcap file according to some rules (preferably/also including Wireshark filters) ?

Answer 1

I don't exactly understand your question, but if I'm right, sed would do the job fine for you. Regex would allow you to surf through the file, pick specific patterns (or even offsets) and substitute them. I use this technique, directly on pcap files when I need to seal confidential info on a file that has to be handed over to a 3rd party.

check here and give it a try :)

Answer 2

I did something like this in perl once by exporting the capture file into text with wireshark, then building that text file into an array where every packet in hex was an entry, then I just ran that array into a foreach loop, drilling down to the GTP layer and parsing by the IE fields, adjusting the hex values of the IEs in question as needed. Then I printed the array into a new text file (regenerating the hex offsets on the left-hand side was the tricky part), then read the new text file into the text2pcap utility to regenerate it as a .pcap file.