PacketSafari

Packet Slicing

Understand how packet slicing reduces PCAP size and payload exposure, including fixed snaplen, adaptive truncation, and analysis tradeoffs.

Packet slicing can be configured while capturing due to the following restrictions

  • limited disk space
  • limited disk I/O performance
  • legal / privacy requirements
  • limited network I/O (e.g. by packet broker or smart tap)

It can also be retroactively performed for example by using tools like editcap or from within PacketSafari using edit PCAP.

PacketSafari's anoncap workflow also supports boundary-only adaptive truncation during anonymization. Instead of cutting every packet at a fixed byte count, anoncap computes the supported protocol boundary for each packet, preserves useful nested headers first, and then truncates. This is especially helpful for tunneled captures where a fixed snaplen would otherwise remove the inner IP or transport header you still need for analysis.

The standalone anoncap default now uses this boundary-only adaptive behavior. There is no fixed 256-byte default target. If you pass --snaplen <bytes>, that value becomes a fixed slicing floor that adaptive mode may extend to preserve supported headers.

Use anoncap --explain-defaults to inspect the current release behavior. --public-share selects the default profile explicitly; --nano-trace is a shorter alias, while --paranoid adds validation, leak scanning, coverage diagnostics, uncovered-field warnings, and failure explanations.

The underlying anoncap CLI also supports a zero-after-boundary mode. Instead of shrinking the packet, that mode keeps the original captured length and replaces bytes after the chosen boundary with zeroes.

The consequence of a sliced trace file is that you won't be able to see all the payload of the PCAP.

In most cases you will still be able to perform a basic analysis on layers 2 (Ethernet), 3 (IPv4/IPv6/ARP/DHCP/STP) and 4 (TCP/UDP/ICMP) if your packet slicing is between 64 (if you get lucky) and 128. Usually, it is not enough to capture all layer 7 information and with some protocols that have large headers. Even 512 bytes might not be enough information to be able to analyze packets.

Packet slicing also limits higher-layer insights (object export, HTTP payload inspection, some AI answers). Keep a full-fidelity copy if you may need payload content later.

Adaptive truncation in PacketSafari anoncap

When you anonymize a capture with standalone anoncap, the default unsupported-payload behavior is adaptive-truncate. In PacketSafari workflows that need deep semantic payload anonymization, use the explicit full-payload mode instead.

That tells anoncap to preserve:

  • outer headers
  • tunnel headers
  • inner Ethernet when present
  • inner IP headers
  • inner L4 headers

before truncating the remaining payload.

Current supported tunnel-aware slicing coverage:

  • IP-in-IP
  • GRE
  • ERSPAN
  • MPLS-over-GRE
  • QinQ
  • PPPoE
  • GTP
  • GTP-U with extension headers
  • PFCP-aware mixed control-plane and user-plane captures
  • L2TP
  • Geneve
  • VXLAN
  • VXLAN-GPE
  • Teredo
  • NSH
  • ICMP and ICMPv6 quoted packets

This is still a truncation workflow, not full payload preservation. It is designed to keep the parts of tunneled packets that remain most useful for analysis after anonymization.

If truncation itself is a problem for a downstream tool, zero-after-boundary is the safer fallback. It preserves the original caplen while still destroying payload bytes after the preserved boundary. If a private/deep rules profile must inspect and rewrite L7 semantics, use --unsupported-payload-policy keep.

If your capture uses a tunnel or encapsulation format that is not covered here, contact PacketSafari support and include a small representative sample capture if possible. That is the fastest way for us to validate the stack and add targeted anoncap support safely.

Packet slicing examples

You can use editcap (comes with Wireshark to do packet slicing) to retroactively slice an already existing PCAP.

editcap -s 128 originalfile.pcapng slicedfile.pcapng