Re: Tools to anonymize pcaps with cellular/3gpp traffic

[Dario Lombardo <dario.lombardo.ml () gmail com>]

Hi Ivan
I went through a similar topic some time ago. The answer is: generally
speaking, no. The tools you mentione target specific protocols, which are a
few (ip/tcp/udp ecc), but the cover the majority of traffic. To go to upper
layers you should know the semantic of the protocols you want to anonymize.
Moreover, not all fields are straightforward to change. A 4 bytes integer
can be, a string, whatever its format is, is not straightforward (you could
go to a change in packet len, then lengths have to be changed, etc.). And
that's not all: the fields you're changing could require changes in other
fields. A stupid example: a protocol with an IP + a flag that indicates
whether the IP is from net 10. would require to change both.
If you want to target a specific procol, you should write a software that
knows that protocol and that does the dirty work for you.
Tracewrangler is the most advanced I know, but falls in the aforementioned
category.
Bye.
Dario.

On Wed, Jun 7, 2017 at 8:54 PM, Ivan Nardi <nardi.ivan () gmail com> wrote:

> Hi
> There are a few public available tools that anonymize pcap files, but they
> usually target L2-L4 layers and "standard" protocols (i.e. dns, icmp,...)
> Is there any tool which sanitizes information carried on "3gpp" protocols
> (ranap, bssap, gsm_a dtap, gsm_map, sgsap...) or, at least, on some of them?
>
> I am not looking for something particularly advanced: zeroing mcc and mnc
> (both in imsi and in cell/location information) should be enough, even
> without checksum updating.
>
> The goal is to easily share some pcaps without changing them with an
> hex-editor by hand
>
> I know that I am asking for a very specific tool, but it's worth giving it
> a try...
>
> Thanks in advance
> Ivan
>
> ____________________________________________________________
> _______________
> Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
> Archives:    https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request () wireshark org?subject=
> unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe