Modification of packet content over a trace

Anonymous Monk has asked for the wisdom of the Perl Monks concerning the following question:

Hi All!

I need to use NetPackets library to complete the following: I need to read all packets in a pcap trace, replace all source MAC addresses by a given address and output it to pcap trace. I know how to handle reading the packets and decoding it to obtain MAC using e.g.
my $eth_obj = NetPacket::Ethernet->decode($pkt);...

but do not know how to handle modification and writing back to pcap trace (I know how to output to std. output)
Thanks! Marcin

Comment on Modification of packet content over a trace Download Code

Replies are listed 'Best First'.
Re: Modification of packet content over a trace by Anonymous Monk on Jun 25, 2008 at 08:26 UTC
Try Net::Packet	[reply]
Re^2: Modification of packet content over a trace by Anonymous Monk on Jun 25, 2008 at 09:01 UTC
Is there a way to do it? Documentation says that encoding eth packets is not implemented: `$eth_pkt = NetPacket::Ethernet->encode(params...); # Not implemented`	[reply] [d/l]
Re^3: Modification of packet content over a trace by Anonymous Monk on Jun 25, 2008 at 10:07 UTC
Try Net::Packet	[reply]
Re^4: Modification of packet content over a trace by Anonymous Monk on Jun 25, 2008 at 12:54 UTC
Re: Modification of packet content over a trace by Anonymous Monk on Jun 25, 2008 at 20:24 UTC
I know this is perlmonks and all, but have you looked the the tcprewrite app in the tcpreplay suite? I have used it to do exactly what you ask many times with great results. http://tcpreplay.synfin.net/trac/ http://tcpreplay.synfin.net/trac/wiki/tcprewrite#RewritingLayer2	[reply]