Pcap Analysis and Manipulation Tools

• Pcap Analysis and Manipulation Tools
  • When Wireshark isn’t the right shape
  • Editing and Format Conversion
    • editcap
    • mergecap
    • capinfos
  • Flow Reconstruction
    • tcpflow
  • Pattern Matching
    • ngrep
  • Traffic Replay
    • tcpreplay
  • Deep Protocol Analysis
    • Zeek
  • Flow Analysis
    • argus / ra
  • Quick Reference
  • Key takeaways
  • References

When Wireshark isn’t the right shape

Beyond Wireshark and tshark, a set of specialized tools covers specific tasks: replaying traffic, reconstructing TCP streams, matching payload patterns, and deep protocol analysis. This page covers the most useful ones. For packet crafting and programmatic access see Scapy and dpkt.

All tools on this page read standard pcap/pcapng files and run on Linux. Most are available in Kali and Ubuntu repositories.

Editing and Format Conversion

These ship with Wireshark and are available on all platforms.

editcap

Slices, trims, anonymizes, and converts capture files. The Swiss army knife for pcap preprocessing.

# Extract packets 100–200 from a large capture
editcap -r capture.pcapng out.pcapng 100-200

# Split into 10,000-packet files
editcap -c 10000 capture.pcapng chunk.pcapng
# produces chunk_00000.pcapng, chunk_00001.pcapng, ...

# Trim to a time window
editcap -A "2025-01-15 08:00:00" -B "2025-01-15 09:00:00" capture.pcapng window.pcapng

# Anonymize IP addresses (pseudonymize with a consistent mapping)
editcap --anonymize-fields capture.pcapng anon.pcapng

# Convert between formats (pcap ↔ pcapng, etc.)
editcap -F pcap capture.pcapng legacy.pcap

mergecap

Merges multiple capture files into one, sorted by timestamp.

# Merge all pcapng files in a directory
mergecap -w combined.pcapng *.pcapng

# Merge without resorting by time (faster, preserves order)
mergecap -a -w combined.pcapng a.pcapng b.pcapng

capinfos

Prints statistics about a capture file — useful for quick triage before analysis.

capinfos capture.pcapng

Example output:

File name:           capture.pcapng
File type:           Wireshark/... - pcapng
File encapsulation:  Ethernet
Packet size limit:   file hdr: (not set)
Number of packets:   142,891
File size:           87 MB
Data size:           84 MB
Capture duration:    3600.123 seconds
First packet time:   2025-01-15 08:00:00
Last packet time:    2025-01-15 09:00:00
Data byte rate:      23,765 bytes/s
Data bit rate:       190,124 bits/s
Average packet size: 591.23 bytes
Average packet rate: 39.69 packets/s

Flow Reconstruction

TCP sends application data as a stream broken into segments — individual packets that may arrive out of order, be retransmitted, or be split at different boundaries each run. A single HTTP response or credential exchange may be split across dozens of packets. Reassembling them in sequence order to recover the full application payload is called TCP stream reconstruction, and it is essential for reading anything above the transport layer.

tcpflow

Reconstructs TCP streams from a pcap file and writes each flow to a separate file. Useful for extracting HTTP bodies, plaintext credentials, file transfers, and other application-layer content.

sudo apt install tcpflow

Basic usage — reconstruct all flows from a capture:

tcpflow -r capture.pcapng -o flows/

Each flow is written to a file named by its five-tuple:

flows/010.000.000.001.80-010.000.000.002.54321
flows/010.000.000.002.54321-010.000.000.001.80

Apply a BPF filter (reduces noise):

tcpflow -r capture.pcapng -o flows/ 'tcp port 80'

Generate a flow report (connection summary):

tcpflow -r capture.pcapng -o flows/ -T '%T %t %A:%a > %B:%b (%l bytes)'

Worked example — extract HTTP content from a capture:

tcpflow -r http_capture.pcapng -o http_flows/ 'tcp port 80'
ls http_flows/
# 192.168.001.010.45678-093.184.216.034.00080   (client→server: HTTP request)
# 093.184.216.034.00080-192.168.001.010.45678   (server→client: HTTP response)

# The server→client file contains the raw HTTP response including body
file http_flows/093.184.216.034.00080-192.168.001.010.45678
grep -a "Content-Type" http_flows/093.184.216.034.00080-192.168.001.010.45678

tcpflow handles out-of-order segments and retransmissions correctly. It does not decrypt TLS — for encrypted traffic, combine with an SSL keylog file and Wireshark/tshark decryption first.

Pattern Matching

ngrep

ngrep applies regular expressions to packet payloads. Think grep for network traffic — works on live interfaces or pcap files.

sudo apt install ngrep

Search a pcap for a string pattern:

ngrep -I capture.pcapng "password"

Case-insensitive regex across HTTP traffic:

ngrep -I capture.pcapng -i "user.?agent" 'tcp port 80'

Live capture with pattern match:

sudo ngrep -d eth0 "Authorization:" 'tcp port 80 or tcp port 443'

Show only matching packets, no hex dump:

ngrep -q -I capture.pcapng "POST"

Useful flags:

Worked example — find cleartext credentials in a capture:

# Look for HTTP Basic auth headers
ngrep -q -W byline -I suspicious.pcapng "Authorization: Basic" 'tcp port 80'

# Look for POST bodies with common credential field names
ngrep -q -i -I suspicious.pcapng "passwd|password|secret|token" 'tcp port 80'

Traffic Replay

tcpreplay

Replays a pcap file onto a live network interface at controlled rates. Used for testing IDS/IPS rules, firewall behaviour, and network tool performance against real-world traffic.

sudo apt install tcpreplay

The tcpreplay suite has three main binaries:

Basic replay at original capture speed:

sudo tcpreplay -i eth0 capture.pcapng

Replay at a fixed rate:

# 10 Mbps
sudo tcpreplay -i eth0 --mbps=10 capture.pcapng

# 2× original speed
sudo tcpreplay -i eth0 --multiplier=2.0 capture.pcapng

# As fast as possible (loop test)
sudo tcpreplay -i eth0 --topspeed capture.pcapng

Loop N times:

sudo tcpreplay -i eth0 --loop=5 capture.pcapng

Rewrite IP addresses before replay (tcprewrite):

# Map original source subnet to a new one
tcprewrite --infile=capture.pcapng --outfile=rewritten.pcapng \
    --srcipmap=10.0.0.0/8:192.168.1.0/24

# Rewrite both src and dst MACs (needed when replaying on a different network)
tcprewrite --infile=capture.pcapng --outfile=rewritten.pcapng \
    --enet-smac=00:11:22:33:44:55 --enet-dmac=aa:bb:cc:dd:ee:ff

Worked example — test a Suricata rule against a pcap:

# 1. Rewrite destination IP to point at your test target
tcprewrite --infile=malware_c2.pcapng --outfile=test.pcapng \
    --dstipmap=0.0.0.0/0:192.168.100.5/32

# 2. Replay against the interface Suricata monitors
sudo tcpreplay -i eth0 --mbps=1 test.pcapng

# 3. Check Suricata's eve.json for alerts
tail -f /var/log/suricata/eve.json | jq 'select(.event_type=="alert")'

Deep Protocol Analysis

Zeek

Zeek (formerly Bro) is a network analysis framework that generates structured logs from pcap files or live traffic. Rather than storing raw packets, Zeek produces per-connection, per-protocol log files — conn.log, http.log, dns.log, ssl.log, files.log, etc. — that are easy to query with standard tools.

sudo apt install zeek   # or zeek-lts on older distros

Analyze a pcap file:

zeek -r capture.pcapng
ls *.log
# conn.log  dns.log  http.log  ssl.log  files.log  weird.log  ...

Key log files:

Querying logs with zeek-cut (extracts columns by name):

# All destination IPs and ports from conn.log
zeek-cut id.resp_h id.resp_p < conn.log | sort | uniq -c | sort -rn | head 20

# HTTP user agents seen in the capture
zeek-cut user_agent < http.log | sort | uniq -c | sort -rn

# DNS queries, grouped by query name
zeek-cut query < dns.log | sort | uniq -c | sort -rn | head 20

# TLS SNI values (what HTTPS hosts were contacted)
zeek-cut server_name < ssl.log | sort -u

Extract files from a capture:

zeek -r capture.pcapng /opt/zeek/share/zeek/policy/frameworks/files/extract-all-files.zeek
ls extract_files/
# extract-1234-HTTP-abc123   extract-5678-SMTP-def456  ...
file extract_files/*

Worked example — identify C2 beaconing from a capture:

zeek -r malware_capture.pcapng

# Look for connections with suspiciously regular intervals (beaconing)
# conn.log has duration and bytes per connection
zeek-cut ts id.orig_h id.resp_h id.resp_p proto orig_bytes resp_bytes < conn.log \
    | awk '$5 == "tcp"' \
    | sort -k3,3 -k4,4n > sorted_conns.txt

# Check SSL log for unusual certificate subjects or missing SNI
zeek-cut ts id.orig_h id.resp_h server_name subject < ssl.log \
    | grep -v "^#" | awk '$4 == "-"'   # connections with no SNI

Flow Analysis

argus / ra

argus captures network flows (aggregated connection records) rather than individual packets. The ra (record argus) tool reads argus output and queries it. Useful for long-term traffic analysis where storing full packet content is impractical.

sudo apt install argus-client argus-server

Generate flow records from a pcap:

argus -r capture.pcapng -w flows.argus

Query flow records:

# All flows, summary format
ra -r flows.argus -n

# Filter to a specific host
ra -r flows.argus -n -s stime dur src dst proto sport dport bytes pkts \
    -- host 10.0.0.5

# Top talkers by bytes
ra -r flows.argus -n -s src bytes -c ',' | sort -t',' -k2,2rn | head 20

For most course tasks Zeek’s conn.log covers the same ground more conveniently. argus is more common in SOC and long-term NetFlow contexts.

Quick Reference

Key takeaways

• These tools fill the gaps around Wireshark/tshark: editcap/mergecap/capinfos preprocess and triage captures; tcpflow reassembles TCP streams to recover application payloads.
• ngrep is grep for packet payloads (live or from a file); tcpreplay (+tcprewrite) replays captures onto an interface to exercise IDS/IPS and firewalls.
• Zeek turns a pcap into structured per-protocol logs (conn.log, dns.log, http.log, ssl.log, files.log) you can slice with zeek-cut — often the fastest path from capture to answer.
• argus/ra records aggregated flows rather than packets, for long-term analysis where keeping full payload is impractical — see Network flow analysis.
• None of these decrypt TLS on their own: decrypt first with an SSLKEYLOGFILE in Wireshark/tshark, then reconstruct or pattern-match.

References

• tcpreplay documentation. https://tcpreplay.appneta.com/wiki/tcpreplay-man.html
• tcpflow on GitHub. https://github.com/simsong/tcpflow
• ngrep man page. https://linux.die.net/man/8/ngrep
• Zeek documentation. https://docs.zeek.org/
• Zeek log reference. https://docs.zeek.org/en/master/logs/index.html
• argus — QoSient / openargus. https://openargus.org/

Related course pages: Analyzing traffic with Wireshark · tshark on the command line · Network flow analysis · Packet crafting with Scapy

🛠️ Maintenance note: package names and invocations drift between Kali/Ubuntu releases (e.g. zeek vs zeek-lts, Zeek’s extract-all-files.zeek policy path, and argus client/server splits). Zeek log fields and zeek-cut column names also change across major versions — re-check the linked docs each term.