Anoncap in PacketSafari · Documentation

PacketSafari uses anoncap as a managed background workflow around the original uploaded capture. The product keeps the source file, creates an anonymized sibling capture, and exposes a compact mapping artifact for follow-up review.

This page explains the PacketSafari product integration: where anoncap runs, how it creates sibling captures, and how mapping lookup and AI policy connect to the analyzer. For the downloadable CLI, see the anoncap reference.

In the upload dialog

Enable Anonymize before upload in the upload metadata step.

PacketSafari then:

stores the original upload first
queues anoncap as a background follow-up task
creates the anonymized result as a separate sibling capture
shows progress in the upload task UI
exposes Open anonymized copy when the sibling is ready

Product controls

Today the main productized anoncap controls are:

Sanitize pcapng metadata for section/application metadata, interface metadata, address info, name-resolution blocks, and decryption-secret blocks
Sanitize comments for capture comments and per-packet comments
Unsupported payload handling
Slice bytes
deterministic mapping and address-shape preservation toggles

Both metadata and comment sanitization default to on in the upload workflow.

PacketSafari also has a narrow media-scrub option for --rtp-silence-replacement. It is opt-in and currently targets RTP v2 over UDP with static payload types 0 (PCMU) and 8 (PCMA).

PacketSafari vs standalone CLI

Need	PacketSafari managed anoncap	anoncap CLI
Create a separate anonymized sibling in the app	Yes	No
Run during upload	Yes	No
Run against an already uploaded capture	Yes	No
Show background progress and completion state	Yes	CLI output only
Keep mapping report tied to the capture	Yes	Optional local report
Search mappings from the analyzer	Yes	No
Integrate with Agent, Copilot, and on-prem AI policy	Yes	No
Local offline command-line rewrite	Use the product workflow	Yes

The standalone anoncap default uses boundary-only adaptive payload truncation: it preserves supported tunnel, L3, L4, and ICMP quote headers, then truncates at the computed boundary. Slice bytes is not the default adaptive behavior; it is an optional fixed floor for workflows that need a minimum retained byte count. Use full-payload keep mode when a private/deep rules profile must retain and rewrite L7 semantic fields.

Public CLI and private PacketSafari profiles

The public anoncap release is the open-source CLI artifact. It is useful for local baseline anonymization and public-share workflows.

Agent Pro subscriptions and private on-prem deployments can include PacketSafari-maintained anoncap configuration for deeper sanitization than the public baseline profile:

Capability	Open-source anoncap	Private PacketSafari profile
Public CLI bundle	Included	Included with private workflow support
Default field anonymization	Core public rules	PacketSafari-maintained DeepAnon profile
Deep packet sanitization	Limited public profile	Expanded enterprise rules for sensitive identifiers and payload metadata
Telecom, subscriber, and enterprise protocol tuning	Public baseline	Broader regression-guarded coverage for Agent Pro and on-prem workflows
Deployment model	Self-managed CLI	Agent Pro subscription or private on-prem deployment

Runtime guidance

Anoncap is usually much faster when the capture is already minimal. If you can safely export only the time window, hosts, or conversations you need before upload, do that first.

Smaller captures mean less packet data to dissect, a smaller replacement set to carry through the run, and fewer rewritten packets to re-check afterward.

If you want to trim first, see Make a PCAP File Smaller.

In the capture library

From the PCAP list actions, PacketSafari supports:

Anoncap anonymize for an already uploaded capture

Library anonymize actions also run as background follow-up tasks. The source capture stays in place and the anonymized result is added as a clearly labeled sibling.

Mapping report and anon lookup

For completed anonymized captures, PacketSafari keeps a compact mapping report artifact. You can:

download the JSON report from capture actions
open the full mapping report inside the analyzed capture view
use Anon lookup from the analyzer actions menu

Anon lookup gives you a small movable search overlay so you can search original values, anonymized values, fields, and replacement sources without leaving the analyzer.

Passes, validation, and leak checks

For deeper runs, it helps to think of the engine as a layered pipeline:

structured field-aware rewrite during the main dissection/write path
a finished-output payload postprocess pass that rescans payload ranges with the accumulated replacement set
a validation pass that redisects modified output packets and checks parser health
an optional leak-verification pass in the standalone CLI / deeper verification path that rescans for survivor values

The slow cases are usually the ones with reassembled or nested protocol ownership. Some SIP, Diameter, and similar TCP-stream fields are only authoritative in the reassembled view, so anoncap may need to patch that reassembled span and then back-project the edit into the owning packet or segment bytes while still keeping lengths, checksums, and parser state coherent.

Plan and deployment note

In hosted SaaS, anoncap workflows are part of Copilot Pro and higher plans. On-prem deployments can use the same workflow with additional admin policy control over whether AI is allowed on non-anonymized captures.