PCAP Privacy Review: What Header Masking Does Not Remove
A practical privacy checklist for packet captures and an explicit account of PCAP Surgery's current partial coverage.
Packet captures can expose addresses, hostnames, cookies, credentials, DNS names, HTTP headers, TLS SNI, file paths, proprietary messages, and customer data. Rewriting an IPv4 header does not remove those values from application payloads.
Start with the recipient's diagnostic need
Decide whether the recipient needs transport timing, endpoint roles, DNS queries, TLS negotiation, HTTP headers, payload bytes, or only a narrow failure window. Removing too much can destroy the evidence; removing too little can expose unrelated customer data.
What PCAP Surgery can show today
For the selected full or subset artifact, the bounded exposure inventory reports supported visible categories including IPv4, IPv6, MAC, DNS names, HTTP Host, TLS SNI, printable payload, and unknown protocol content. It also reports truncated inspection, encryption, fragmentation, malformed data, and unsupported link types as unresolved conditions.
What it cannot prove
- It does not decrypt encrypted application data.
- It does not reassemble values split across packets.
- It does not understand every protocol or proprietary payload.
- It does not remove arbitrary payload fields.
- It does not issue a safe-to-share verdict.
Use the inventory to direct manual review, not to replace an approved fail-closed sanitization pipeline. Preserve the original, document every transformation, and independently validate the output before it leaves the organization.
See the truthful header-masking sample or try the local Community workflow.