JSON2PCAP

research

Reconstructs and modifies PCAPs from tshark JSON using a position-based hex overlay.

Round-trip tshark JSON → PCAP via position-based hex overlay. Edit any decoded layer; the most specific change wins. Built-in masking, anonymisation with salt, and --fix-checksums.

A Python CLI that converts tshark -T json -x output back into a PCAP. Uses a position-based hex overlay: collects every _raw field, sorts by position ascending and length descending, then overlays each field's bytes onto frame_raw, shorter (more-decoded) fields overwrite longer ones, so the most specific decoded field always wins. With no fields modified, the output is bit-for-bit identical to the input. Also supports masking, SHAKE-style anonymisation (with optional salt), and checksum fixup.

What it does

• Reconstructs packets from tshark -T json -x descriptions by overlaying decoded _raw fields onto frame_raw at their original position.
• Sorts fields longest-first so shorter, more-decoded fields take precedence, edit at any layer.
• Bit-identical round-trip when no fields are modified.
• Per-field masking with -m and SHAKE-style anonymisation with -a (optional salt via -s).
• Modification mask prevents later (less-decoded) fields from overwriting already-anonymised bytes.
• --fix-checksums flag to repair IP / TCP / UDP checksums after edits.
• Streaming JSON parse via ijson, handles very large tshark dumps.
• Standalone CLI; no server component required.

Best for

• Researchers building reproducible test corpora.
• Detection engineers automating scenario generation.
• Engineers scripting capture transformations in CI / pipelines.

Inputs: tshark JSON (-T json -x)

Outputs: PCAP (reconstructed / modified / anonymised)