Edit tcp packets in pcap file

Question

I need to make tcpdump using wireshark or tcpdump
For some tcp streams in log I need full packet info. But for tcp streams in log I need to remove all info except full uri info.

For this I'am going to use regular expressions.
If URI, http.request or http.response match some of regular expressions
then I need to store full tcp stream info.
If doesn't match --- then I need to remove all tcp stream info except full uri info.

I need it to reduce log size.

What tool do you advise for this ?
Or may be some php/python library will be helpful to create script that will filter log ?

Answer 1

tcpick and tcpxtract are two tools available to filter and extract information from a tcpdump file. They are both open-source and available at sourceforge.net. You will have to write your own routine for how and what information you would like to extract. tcpick is fairly flexible regarding what parts of a packet you can view/extract.

Answer 2

I use TraceWrangler in my projects, which despite being beta, works very well. It allows, in addition to editing the L2/L3 headers, to sanitize the packets.