PCAP Anonymizer

pcap

Browser-based PCAP anonymisation using Wiregasm dissection, SHAKE256 hashing, and field masking.

Drop a PCAP, filter with Wireshark display syntax, click fields to anonymise, SHAKE256 hashing or 0xFF masking, with optional salt and slice notation. Browser-only, no upload.

Sanitises packet captures so they can be safely shared with partners, students, or external auditors. Dissects packets in the browser via Wiregasm (Wireshark compiled to WebAssembly), then applies per-field SHAKE256 hashing or 0xFF masking, with optional slice notation for partial anonymisation. All processing is client-side.

What it does

• Dissects packets in-browser using Wiregasm (Wireshark WASM port).
• Filters packets with Wireshark display-filter syntax.
• Per-field SHAKE256 hashing with optional salt for deterministic pseudonymisation across runs.
• 0xFF masking for fields where format preservation is not needed.
• Slice notation (field[start:end]) to anonymise only parts of a field.
• Interactive UI: click any decoded field to add an anonymisation rule.
• Exports a new PCAP with the modified frames.

Best for

• Teams sharing captures with external researchers.
• Trainers preparing sanitised teaching material.
• Operators redacting subscriber identifiers before external review.

Protocols: IP, SS7, Diameter, GTP, SIP

Inputs: PCAP, PCAPNG, Wireshark display filters

Outputs: Anonymised PCAP