flowscrub

Description

flowscrub provides multi-format (pcap, netflow, silk), multi-layer (link, network, transport, application), and multi-attribute (ethernet.src, ip.ttl, tcp.sport, http.uri, etc) transformations (set, zero, mask, rand, hash, etc) for flexible and powerful flow anonymization using simple configuration files.

Sample Usage

smi:/Volumes/pcap jonojono$ ls -lh
-rw-r--r--  1 root  wheel   568M 24 Aug  2006 2006-08-24.01.pcap.gz
-rw-r--r--  1 root  wheel   421M 24 Aug  2006 2006-08-24.02.pcap.gz
-rw-r--r--  1 root  wheel   428M 24 Aug  2006 2006-08-24.03.pcap.gz
...
smi:/Volumes/pcap jonojono$ flowscrub.py -f pcap -c scrub.conf 2006-08-24.*.pcap.gz
scrubbing 2006-08-24.01.pcap.gz...done
scrubbing 2006-08-24.02.pcap.gz...done
scrubbing 2006-08-24.03.pcap.gz...done
...

Sample scrub.conf

pcap.ts timedelta
ethernet.src zero
ethernet.dst zero
ip.src mask 16
ip.dst hash
tcp.sport zero

Download

Release coming soon...

Project Management

flowscrub's SVN repository and bug tracking is hosted at Google Code.