anoncap reference

anoncap is a standalone pcap/pcapng anonymizer built on Wireshark's capture and dissector stack. It rewrites supported identifiers, strips sensitive capture metadata, and writes an anonymized capture that remains useful for troubleshooting and sharing.

PacketSafari uses the same engine and adds managed upload, sibling capture handling, mapping lookup, AI-policy integration, and the private DeepAnon rules profile. For the product workflow, see Anoncap in PacketSafari.

Name

anoncap - anonymize packet captures while preserving protocol structure.

Synopsis

anoncap [options] <input> [output]
anoncap -r <input> [-w <output>] [options]
anoncap --batch [options]
anoncap --batch-coherent [options]
anoncap --write-default-rules <path>
anoncap --explain-defaults

If you pass only an input path, anoncap writes <input-stem>-anon.pcapng next to the source capture. Existing output paths are refused unless --overwrite is set.

Download

Latest public release assets:

• Linux x64
• macOS Apple silicon
• macOS Intel x64
• Windows x64
• Release notes and checksums

The assets are runnable bundles containing the binary, required shared libraries, public baseline rules, and checksums. They are not single naked binary files.

Linux:

wget https://github.com/oripka/wireshark/releases/latest/download/anoncap-linux-x64.tar.gz
tar -xzf anoncap-linux-x64.tar.gz
cd anoncap
./bin/anoncap --version

macOS Apple silicon:

curl -L -o anoncap-macos-arm64.tar.gz https://github.com/oripka/wireshark/releases/latest/download/anoncap-macos-arm64.tar.gz
tar -xzf anoncap-macos-arm64.tar.gz
cd anoncap
./bin/anoncap --version

macOS Intel:

curl -L -o anoncap-macos-x64.tar.gz https://github.com/oripka/wireshark/releases/latest/download/anoncap-macos-x64.tar.gz
tar -xzf anoncap-macos-x64.tar.gz
cd anoncap
./bin/anoncap --version

Windows PowerShell:

Invoke-WebRequest `
  -Uri "https://github.com/oripka/wireshark/releases/latest/download/anoncap-windows-x64.zip" `
  -OutFile "anoncap-windows-x64.zip"
Expand-Archive .\anoncap-windows-x64.zip -DestinationPath .
Set-Location .\anoncap
.\bin\anoncap.exe --version

The macOS and Windows bundles are unsigned. If the OS blocks the binary after download, allow it according to your local security policy, then rerun --version before processing captures.

Quick Start

./bin/anoncap input.pcapng

Equivalent explicit public-share forms:

./bin/anoncap --public-share input.pcapng
./bin/anoncap --nano-trace input.pcapng

Choose an output path:

./bin/anoncap -r input.pcapng -w output-anon.pcapng
./bin/anoncap input.pcapng output-anon.pcapng

Inspect the release defaults:

./bin/anoncap --explain-defaults

Run the slower audit preset:

./bin/anoncap --paranoid input.pcapng --report anon.report.json

Default Behavior

The default profile is the public-share profile. It is designed for common public trace sharing where L7 payload bytes should be reduced while network and troubleshooting structure stays readable.

Current defaults:

• anonymizes L2-L4 identifiers, including MAC, ARP-linked values, IPv4, IPv6, TCP/UDP-adjacent fields, ICMP, DHCP, DNS, safe HTTP/HTTP2 host fields, TLS SNI, and X.509 DNS names where supported
• preserves broad topology shape: RFC1918, loopback, link-local, multicast, IPv6 ULA/link-local/multicast classes, IPv4 subnet shape, IPv6 prefix shape, and MAC OUI shape
• uses deterministic mappings within one run
• strips sensitive pcapng metadata by default: comments, name-resolution blocks, decryption secrets, application/OS strings, interface metadata, and address info
• preserves packet count, timestamps, interface linkage, and supported headers
• performs boundary-only adaptive packet slicing by default
• does not use a fixed 256-byte target unless you explicitly request a fixed --snaplen
• keeps unknown top-level encapsulations whole rather than cutting at a guessed boundary
• does not run redissection validation or leak verification unless requested
• prints a concise stderr summary after successful runs

Default adaptive slicing preserves supported nested/tunnel and quote headers before truncating later payload bytes. Current public coverage includes GRE, TEB/Ethernet-in-GRE, ERSPAN, IP-in-IP, IPv6-in-IP, VXLAN, VXLAN-GPE, Geneve, GTP-U/GTPv2 UDP payloads, L2TP, Teredo, ICMP/ICMPv6 quoted packets, PPPoE, MPLS, NSH, and inner L3/L4 headers.

Options

Input and output

Presets

Rules and forced values

Batch modes

--batch launches separate processing per file and does not guarantee coherent mappings across files. --batch-coherent keeps one mapping context across all files in the run.

Batch modes process regular .pcap, .pcapng, and .cap files. Entries whose name contains -anon are skipped so anonymized siblings are not reprocessed. Files are scanned in sorted order, and outputs are named <input-stem>-anon.pcapng.

Plain --batch does not support --map-out, --report, or --diagnostics-out. --batch-coherent supports --map-out, but does not support --report, --diagnostics-out, --display-filter, --safe-diagnostics, or --pdml.

Payload reduction

Invalid combinations are rejected. For example, --unsupported-payload-policy keep cannot be combined with --snaplen or --adaptive-snaplen, because keep means no slicing unless a separate fixed policy is chosen.

Validation and leak checks

Reports and machine-readable output

RTP media scrub

Broad dynamic-payload codec replacement, video RTP, Opus, AMR, G.729, and SRTP-aware media handling are not the current public guarantee.

Progress and debugging

Exit Behavior

anoncap returns non-zero for malformed input, invalid rules, unsupported required transforms, output conflicts, validation failure, leak-check failure under the active policy, and other processing failures. It refuses to overwrite existing output paths unless --overwrite is supplied.

Output Artifacts

Examples

Default public-share run:

./bin/anoncap input.pcapng

Explicit output:

./bin/anoncap -r input.pcapng -w output-anon.pcapng

Audit run:

./bin/anoncap \
  --paranoid \
  input.pcapng \
  --report anon.report.json \
  --diagnostics-out anon.diag.jsonl \
  --map-out anon.map.json

Coherent dumpcap fileset:

cd capture-fileset
../anoncap/bin/anoncap --batch-coherent --recursive --map-out anoncap-map.json

Fixed slicing floor:

./bin/anoncap input.pcapng output-sliced.pcapng --snaplen 512

Zero payload tail after the selected boundary:

./bin/anoncap input.pcapng output-zero-tail.pcapng \
  --snaplen 256 \
  --unsupported-payload-policy zero-after-boundary

Keep full payload bytes for a custom/deep rules profile:

./bin/anoncap input.pcapng output-deep.pcapng \
  --rules anoncap-rules.json \
  --unsupported-payload-policy keep

Forced sensitive-value scrub:

./bin/anoncap input.pcapng output-anon.pcapng \
  --params sensitive-values.txt \
  --params-anon-out anonymized-values.txt

RTP G.711 silence replacement:

./bin/anoncap input.pcapng output-rtp-silence.pcapng \
  --rtp-silence-replacement \
  --unsupported-payload-policy keep

Rules JSON

Rules JSON lets you extend or replace the built-in public profile. The current shipped model is intentionally field-oriented: match a Wireshark field abbreviation, classify the value shape, and choose the narrowest compatible transform.

Minimal file:

{
  "rule_sets": [
    {
      "id": "custom",
      "rules": [
        {
          "id": "diameter-origin-host",
          "enabled": true,
          "match": {
            "kind": "field_exact",
            "value": "diameter.Origin-Host"
          },
          "transform": {
            "kind": "shape_preserving_hostname"
          }
        }
      ]
    }
  ]
}

Top-level keys

The built-in public rules can be exported with:

./bin/anoncap --write-default-rules anoncap-rules.json

If --rules is omitted, anoncap first looks for anoncap-rules.json in the current working directory, then ./anoncap-rules.json, and then falls back to the built-in public rules JSON compiled into the binary.

Rule sets and rules

Each rule entry supports:

Use field_exact for normal authoring. It matches one exact Wireshark field abbreviation such as ip.src, tls.handshake.extensions_server_name, or diameter.Origin-Host.

Transform kinds

Rules alone are usually enough only when the field owns a patchable packet byte span and the encoding is already supported. Label-encoded names, TBCD identifiers, UTF-16 strings, reassembled payload ownership, generated fields, and packet-level fallbacks can require engine support in addition to a JSON rule.

Metadata policy

{
  "metadata_policy": {
    "preserve_name_resolution": false,
    "preserve_decryption_secrets": false,
    "preserve_comments": false,
    "preserve_application_metadata": false,
    "preserve_interface_metadata": false,
    "preserve_address_info": false
  }
}

Supported keys:

• preserve_name_resolution
• preserve_decryption_secrets
• preserve_comments
• preserve_application_metadata
• preserve_interface_metadata
• preserve_optional_interface_metadata (alias for interface metadata preservation)
• preserve_address_info

The public default strips these sensitive/optional metadata classes.

Diagnostics policy

{
  "diagnostics_policy": {
    "coverage_scan": true,
    "flag_unanonymized_fields": true,
    "debug_spans": false,
    "debug_raw_values": false
  }
}

CLI flags can also enable these behaviors. Raw-value diagnostics should only be used in controlled local debugging.

Transform policy

{
  "transform_policy": {
    "ipv4": {
      "preserve_rfc1918_class": true,
      "preserve_loopback_class": true,
      "preserve_link_local_class": true,
      "preserve_multicast_class": true,
      "preserve_subnet_shape": true,
      "preserve_last_octet_special_cases": true
    },
    "ipv6": {
      "preserve_ula_class": true,
      "preserve_link_local_class": true,
      "preserve_multicast_class": true,
      "preserve_prefix_shape": true
    }
  }
}

MAC OUI preservation is part of the public default engine behavior. The current public CLI does not expose separate command-line toggles for these topology-preservation settings; use a rules JSON profile when you need policy changes.

Advanced helpers

{
  "advanced_helpers": {
    "sdp_inline_rewrites": true,
    "sip_payload_rewrites": true,
    "diameter_value_rewrites": true,
    "diameter_unknown_vendor_rewrites": false,
    "generic_payload_rewrites": true,
    "force_generic_payload_rewrite": true,
    "rtp_silence_replacement": false,
    "named_value_rewrites": true,
    "private_sip_vendor_rewrites": false,
    "tel_text_rewrites": true,
    "sip_header_restore": true,
    "sip_content_length_update": true
  }
}

These switches are for curated rules profiles. Do not enable broad helpers casually; protocol-specific helpers can alter payload handling and should be validated on representative captures.

Public vs DeepAnon

The public standalone baseline is conservative. It covers network identifiers, topology-preserving address mapping, safe DNS/DHCP/HTTP/HTTP2/TLS/X.509 name paths, metadata stripping, adaptive slicing, audit switches, and custom rules.

The private PacketSafari / DeepAnon profile is broader and corpus-driven. It adds deeper telecom, enterprise identity, Windows auth/name, mobile-core, RADIUS, SIP/SDP, Diameter, PFCP/GTP/S1AP/NGAP/NAS, and selected OT coverage through a private rules file plus private regression tests.

Related Docs

• Anoncap in PacketSafari
• Capability matrix
• Tool comparison