flowscrub

flowscrub provides multi-format (pcap, netflow, silk), multi-layer (link, network, transport, application), and multi-attribute (ethernet.src, ip.ttl, tcp.sport, http.uri, etc) transformations (set, zero, mask, rand, hash, etc) for flexible and powerful flow anonymization using simple configuration files.

sample usage:

smi:/Volumes/pcap jonojono$ ls -lh
-rw-r--r-- 1 root wheel 568M 24 Aug 2006 2006-08-24.01.pcap.gz
-rw-r--r-- 1 root wheel 421M 24 Aug 2006 2006-08-24.02.pcap.gz
-rw-r--r-- 1 root wheel 428M 24 Aug 2006 2006-08-24.03.pcap.gz
...
smi:/Volumes/pcap jonojono$ flowscrub.py -f pcap -c scrub.conf 2006-08-24.*.pcap.gz
scrubbing 2006-08-24.01.pcap.gz...done
scrubbing 2006-08-24.02.pcap.gz...done
scrubbing 2006-08-24.03.pcap.gz...done
...sample scrub.conf

pcap.ts timedelta
ethernet.src zero
ethernet.dst zero
ip.src mask 16
ip.dst hash
tcp.sport zero

Tags

  anonymization flow scrub python pcap trace packet netflow dpkt

Share