PacketSafari

Capability matrix

Detailed anoncap capability reference for telecom, enterprise identity, tunnels, packet shape, metadata hygiene, and analyzable anonymized captures.

PacketSafari anoncap is strongest when protocol context matters. It focuses on identifier-aware anonymization that keeps captures useful for troubleshooting, escalation, and AI review.

For a shorter first-pass guide, start with How to anonymize a PCAP.

Protocol coverage

DeepAnon is sold on protocol coverage

PacketSafari anoncap is built for captures where the protocol family matters: telecom traces, enterprise authentication, nested tunnels, host identity, and analyzable packet shape. The private profile is where the deepest protocol-specific coverage lives.

Telco-first

SIP, IMS, Diameter, GTP, PFCP, S1AP, NGAP, NAS, GSM MAP, and TCAP are explicit design centers.

Identity-aware

PacketSafari targets structured identifiers instead of flattening the capture into opaque bytes.

Shape-preserving

Address classes, subnets, MAC OUI families, tunnels, and packet timing stay useful for investigation.

Coverage by protocol family

Public anoncap provides the baseline. PacketSafari private DeepAnon adds protocol-specific rules and regression coverage for sensitive enterprise and carrier captures.

See private options
Family Protocols Public baseline Private DeepAnon profile
Core network identityDeep
IPv4IPv6EthernetMAC/OUIARP
Deep public baselineStable shared engine path with deterministic replacement and shape preservation.
Names and enterprise identityStrong
DNSDHCPDHCPv6SMBNetBIOSKerberosNTLMRADIUS
DNS and DHCP basicsExpanded host, user, domain, SMB, NetBIOS, Kerberos, NTLM, RADIUS, and path cleanup.
Web and certificate identityStrong
HTTPHTTP/2TLSX.509
HTTP host, request URI, TLS SNI, and X.509 DNS namesAdds referer/location handling and private regression anchors for certificate subject names.
Telecom signaling and subscriber identityDeep
SIPIMSDiameterGTPv2PFCPS1APNGAPNAS-5GSGSM MAPTCAPISUP
Limited built-in semantic profileDeep private profile for subscriber, device, realm, APN/DNN, PLMN, TEID, UE, and transport identifiers.
Tunnel and nested capture preservationStrong
GREERSPANVXLANGeneveGTP-UL2TPMPLSPPPoEQinQ
Boundary-aware adaptive slicingRegression-guarded preservation so inner protocol structure remains visible after truncation.
OT and industrial capturesSeeded
ModbusS7commMMSIEC 61850
Structure preservation focusSeed private lane for keeping industrial captures analyzable while removing exposed module and object names.
Payload and metadata hygienePartial
pcapng metadataJSONXMLRTP G.711
Conservative fallback behaviorpcapng metadata stripping, printable JSON/XML fallback, and opt-in G.711 RTP media silence replacement.

Maintained capability areas

  • Telecom and subscriber identities: SIP addressing fields, Diameter public identity fields, IMSI, MSISDN, IMEI / IMEISV, ISUP calling/called numbers, GSM MAP / TCAP identifiers, S1AP PLMN values, GTP device identifiers, NGAP / NAS-5GS identifiers, PFCP fields, and related subscriber/device identifiers.
  • Enterprise identity fields: hostnames, usernames, URIs, SMB paths, Kerberos / NTLM identity strings, RADIUS user identifiers, DHCP names, DNS names, and similar structured fields.
  • Link and network identifiers: Ethernet / MAC addresses, IPv4, IPv6, ARP, DHCP, DNS names and addresses, and related host/location identifiers.
  • Tunnel and nested protocol preservation: adaptive slicing keeps supported inner headers readable so anonymized captures remain useful for real investigations.
  • OT / industrial identifiers: seed support for S7comm module and PLC naming fields, plus OT protocol-shape preservation checks for Modbus, S7comm, and MMS / IEC 61850 captures.
  • pcapng metadata hygiene: section comments, capture application / OS strings, interface names / descriptions / OS metadata, address info, name-resolution blocks, decryption-secret blocks, and per-packet comments can all be stripped in the anonymized output.

PacketSafari has invested disproportionate anoncap tuning and regression coverage into telecom-heavy traffic. In practice that means SIP, IMS, Diameter, NGAP, GTP, PFCP, GSM MAP / TCAP, NAS-5GS, S1AP, and related telco workflows are a major design center for the current deep anonymization profile.

There is now also a smaller OT-focused seed layer in the private regression set. The current practical target is to keep industrial captures analyzable while removing obvious module, object, or dataset names where the dissector exposes them safely.

Public adaptive coverage matrix

The public Wireshark anoncap test suite generates an adaptive coverage matrix artifact while testing the default slicing logic. The matrix records each synthetic tunnel/quote case, the preserved protocol chain, and the output captured length after adaptive slicing. Current generated cases include GRE, GRE ERSPAN, VXLAN, VXLAN-GPE, Geneve, GTP-U with extension headers, L2TP, Teredo, ICMP and ICMPv6 quotes, PPPoE, MPLS, NSH, and inner L3/L4 preservation.

Preserved packet and identity shapes

PacketSafari’s current vendored anoncap profile keeps several shapes readable by default:

  • IPv4 private/public class behavior
  • IPv4 subnet shape
  • IPv6 prefix shape
  • MAC vendor / OUI visibility
  • deterministic replacement stability across one anonymized run

Examples

  • RFC1918 addresses can stay RFC1918-looking instead of turning into public-looking space.
  • Public IPv4 addresses can stay public-looking instead of collapsing into 10.x.x.x.
  • Hosts that were in the same /24 can still look co-located after anonymization.
  • MAC addresses can keep the OUI/vendor-family portion while changing the unique device part.

Adaptive truncation support list

PacketSafari’s current adaptive truncation support is aimed at the most common nested cases we see in real investigations, including:

  • IP-in-IP
  • GRE
  • ERSPAN
  • Ethernet-in-GRE / TEB
  • MPLS-over-GRE
  • QinQ
  • PPPoE
  • GTP
  • GTP-U with extension headers
  • PFCP and mixed PFCP/GTP traces
  • L2TP
  • Geneve
  • VXLAN
  • VXLAN-GPE
  • Teredo
  • ICMP and ICMPv6 quoted packets
  • NSH

RTP media scrub

There is now a narrow opt-in RTP media scrub path for supported G.711 voice payloads:

  • replace RTP voice samples with codec-valid silence bytes
  • preserve packet count, payload type, sequence, timestamp, SSRC, and payload length
  • keep it disabled unless you explicitly want media scrubbed in addition to field-aware anonymization

Related docs