Answers to: command to replace all different IP addresses in pcap file with single IP address<p>I have a pcap file which has multiple IP addresses, I want to replace those multiple IP addresses with single address, is there any command to do so?</p>enTue, 04 Mar 2014 10:16:58 -0800Comment by Hadriel on Jasper's answer<p>Not to mention most protocols are bi-directional, so you'd change from this:</p> <p>A-&gt;B B-&gt;A A-&gt;B B-&gt;A</p> <p>To this:</p> <p>C-&gt;B B-&gt;A C-&gt;B B-&gt;A</p> <p>(or C-&gt;A and C-&gt;B depending on whether all source addresses are changed or not)</p> <p>Kinda silly. :)</p>HadrielTue, 04 Mar 2014 10:16:58 -0800 by Kurt Knochner on Jasper's answer<p>Hm.. that can lead to 'collisions' if different clients (different IPs) are using the same source port to one destination address. The resulting capture file will be useless, as you cannot distinguish the former differing streams. </p> <p>So, why do you want to do that?</p>Kurt KnochnerTue, 04 Mar 2014 09:43:06 -0800 by shubhangi on Jasper's answer<p>sorry, I mean I want to replace multiple SOURCE IP addresses with a single SOURCE IP address using tcprewrite, can you help me out?</p>shubhangiTue, 04 Mar 2014 03:59:02 -0800 by Jasper<p>Why do you want to replace all IP addresses with a single address? That would lead to a file with the IP talking to itself, which is not seen on networks and doesn't make any sense (except for localhost stuff, but you don't see that in a pcap usually).</p> <p>If you want to replace IP addresses you can use <a href="">tcprewrite</a>, <a href="">bittwiste</a> or <a href="">TraceWrangler</a>.</p>JasperTue, 04 Mar 2014 02:42:22 -0800