Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.
2 added answer with regards to the bonus question asked by OP
source | link

You could run sanitize against your capture. Depending on what you want to sanitize, there is a pseudo-workaround for doing this with perl, however what you'd end up doing is mangling things if not done properly. Let's assume you wanted to sanitize on a known known - let's say an IP (10.1.1.2)

(Copy original so you don't mess things up beforehand)

perl -pi -e 's:31 30 2e 31 2e 31 2e 32:31 32 37 2e 30 2e 30 2e 33:g' your.pcap

This will convert the hex of 10.1.1.2 into 127.0.0.3 no matter where it's seen. The issue would be any overlapping hex. You could run tcpdump on the fly and convert it as well: e.g.

tcpdump -R yourfile.pcap | perl -p -e 's:31 30 2e 31 2e 31 2e 32:31 32 37 2e 30 2e 30 2e 33:g' >> new.pcap

Both I have done before with success, however there is room for mangling things. (overlapping hex).


EDITED TO ANSWER YOUR BONUS QUESTION

While it is better to be safe than sorry, you have to have some form of confidence in your vendor otherwise there are bigger problems. The quick non technical solution for this is to ensure any contractual lingo contains information related to privacy either way of an NDA or other legal safeguards.

You could run sanitize against your capture. Depending on what you want to sanitize, there is a pseudo-workaround for doing this with perl, however what you'd end up doing is mangling things if not done properly. Let's assume you wanted to sanitize on a known known - let's say an IP (10.1.1.2)

(Copy original so you don't mess things up beforehand)

perl -pi -e 's:31 30 2e 31 2e 31 2e 32:31 32 37 2e 30 2e 30 2e 33:g' your.pcap

This will convert the hex of 10.1.1.2 into 127.0.0.3 no matter where it's seen. The issue would be any overlapping hex. You could run tcpdump on the fly and convert it as well: e.g.

tcpdump -R yourfile.pcap | perl -p -e 's:31 30 2e 31 2e 31 2e 32:31 32 37 2e 30 2e 30 2e 33:g' >> new.pcap

Both I have done before with success, however there is room for mangling things. (overlapping hex).

You could run sanitize against your capture. Depending on what you want to sanitize, there is a pseudo-workaround for doing this with perl, however what you'd end up doing is mangling things if not done properly. Let's assume you wanted to sanitize on a known known - let's say an IP (10.1.1.2)

(Copy original so you don't mess things up beforehand)

perl -pi -e 's:31 30 2e 31 2e 31 2e 32:31 32 37 2e 30 2e 30 2e 33:g' your.pcap

This will convert the hex of 10.1.1.2 into 127.0.0.3 no matter where it's seen. The issue would be any overlapping hex. You could run tcpdump on the fly and convert it as well: e.g.

tcpdump -R yourfile.pcap | perl -p -e 's:31 30 2e 31 2e 31 2e 32:31 32 37 2e 30 2e 30 2e 33:g' >> new.pcap

Both I have done before with success, however there is room for mangling things. (overlapping hex).


EDITED TO ANSWER YOUR BONUS QUESTION

While it is better to be safe than sorry, you have to have some form of confidence in your vendor otherwise there are bigger problems. The quick non technical solution for this is to ensure any contractual lingo contains information related to privacy either way of an NDA or other legal safeguards.

1
source | link

You could run sanitize against your capture. Depending on what you want to sanitize, there is a pseudo-workaround for doing this with perl, however what you'd end up doing is mangling things if not done properly. Let's assume you wanted to sanitize on a known known - let's say an IP (10.1.1.2)

(Copy original so you don't mess things up beforehand)

perl -pi -e 's:31 30 2e 31 2e 31 2e 32:31 32 37 2e 30 2e 30 2e 33:g' your.pcap

This will convert the hex of 10.1.1.2 into 127.0.0.3 no matter where it's seen. The issue would be any overlapping hex. You could run tcpdump on the fly and convert it as well: e.g.

tcpdump -R yourfile.pcap | perl -p -e 's:31 30 2e 31 2e 31 2e 32:31 32 37 2e 30 2e 30 2e 33:g' >> new.pcap

Both I have done before with success, however there is room for mangling things. (overlapping hex).