PCAP Surgery logo PCAP Surgery PCAP repair and editing

Help

PCAP Surgery Capture Scope and Export Limits

Supported formats

  • Classic PCAP (.pcap) — read, inspect, filter, apply supported transformations, and export to a new classic PCAP
  • Basic PCAPNG (.pcapng) — read and inspect a single-interface Ethernet capture using the supported common block path; export is still classic PCAP

Multi-interface captures, non-Ethernet link types, richer PCAPNG metadata, and vendor-specific blocks are outside the supported PCAPNG guarantee.

File operations

  • Open local PCAP files
  • Filter by protocol, address, port, packet content
  • Inspect decoded packets
  • Keep or drop selected packets, reorder packets, and adjust timestamps
  • Apply fixed-length raw byte edits and supported MAC, IPv4, port, VLAN, TCP/IP field rewrites
  • Repair IPv4/TCP/UDP checksums on supported header rewrite paths
  • Inventory visible IPv4, IPv6, MAC, DNS, HTTP Host, TLS SNI, and printable payload or unknown exposure for the selected full or subset artifact
  • Export the edited or filtered result as a new classic PCAP

The source file is not overwritten.

Privacy and validation boundary

  • The selected-artifact exposure inventory is bounded and partial. It performs no decryption or stream reassembly and does not produce a safe-to-share verdict.
  • IPv4 header masking is not payload redaction. Identifiers may remain in DNS, HTTP, TLS SNI, credentials, IPv6, application payloads, or unknown protocols.
  • Raw byte edits do not automatically repair checksums.
  • The app does not currently perform an automatic post-export reparse or emit a transformation manifest.
  • Re-open important exports in a trusted parser. Complete a separate privacy review before external sharing.

What's not supported

  • Live capture — PCAP Surgery is a file editor, not a packet sniffer
  • General multi-interface or non-Ethernet PCAPNG support
  • Lossless preservation of arbitrary PCAPNG blocks, comments, and metadata
  • Arbitrary payload stripping, packet truncation, or capture splitting
  • Full anonymization or a guarantee that an output is safe to share
  • Non-packet file formats (log files, text dumps, proprietary formats)

For live capture, use tcpdump, Wireshark, or your platform's packet capture tool, then open the resulting file in PCAP Surgery for editing.

Related workflows