PacketSafari

How to anonymize a PCAP

Start with PacketSafari managed anoncap or download the standalone CLI for local PCAP anonymization.
Masked .pcap mascot representing Anoncap producing a safer shareable capture.

Use anoncap when you want an anonymized sibling capture instead of handing the raw PCAP directly to every AI workflow, reviewer, or customer.

Choose your workflow

PacketSafari upload dialog
Enable anonymization before storing the capture
Metadata step
customer-core-dump.pcapng
284 MB · Private workspace · General analysis
Anonymize before upload

Create an anonymized sibling capture before the file is used in AI, sharing, or review workflows.

Default
Sanitize pcapng metadata
Default
Sanitize comments
Result

PacketSafari keeps the original capture and adds the anonymized output as a separate sibling capture.

Enable Anonymize before upload in the upload metadata step when you want PacketSafari to run anoncap as part of the product workflow. The original capture stays available, and PacketSafari creates the anonymized result as a sibling capture when the background task finishes.

Quick steps

  1. Enable Anonymize before upload in the upload dialog, or run Anoncap anonymize from the capture library actions.
  2. Open Configure anoncap if you need to change payload handling or preservation behavior.
  3. Wait for the background task to finish, then open the anonymized sibling capture.
  4. Use the mapping report or Anon lookup when you need to understand what changed.

Quick runtime tip

If possible, anonymize a minimal PCAP instead of a giant raw capture. Trimming the file first by time window, protocol, or conversation usually makes anoncap faster because there is less packet data to dissect, fewer replacements to build, and fewer modified packets to validate afterward.

See Make a PCAP File Smaller if you want to reduce the capture before upload.

What PacketSafari exposes today

  • Deterministic mapping so repeated identities stay stable inside one anonymized run.
  • Coherent fileset mode in the standalone CLI with --batch-coherent, useful for dumpcap ring buffers or multi-point captures that must keep the same replacements across separate output files.
  • Payload controls including Unsupported payload handling, boundary-only adaptive truncation for supported tunnels, optional fixed Slice bytes, full-payload keep mode, and zero-after-boundary behavior in the underlying toolchain.
  • Standalone CLI presets for explicit public sharing (--public-share; --nano-trace is an alias) and slower audit runs (--paranoid), plus --explain-defaults for checking a release bundle.
  • Shape-preservation controls for IPv4 private/public behavior, subnet or prefix shape, and MAC OUI/vendor visibility.
  • Protocol-aware rewriting for fields such as DNS names, DHCP addresses, telco identifiers, hostnames, URIs, and related structured identities.
  • Narrow RTP silence replacement for supported G.711 RTP media when you need voice scrubbing without changing RTP timing behavior.

Open source and other tools

PacketSafari’s product workflow is built around the open-source anoncap implementation in the PacketSafari Wireshark fork.

If you want to compare PacketSafari with other anonymization tools or download the open-source artifact directly, use the dedicated pages below.

Read next

Related docs