PCAP Surgery Overview: From Noisy Capture to Minimal Repro

PCAP Surgery is a local desktop workbench for the step between packet analysis and a support handoff or regression fixture. It helps an operator turn a noisy capture into a focused, reviewable classic PCAP without hiding the planned changes behind a command pipeline.

It is not a live sniffer, a Wireshark replacement, or a complete sanitization system.

Core workflow

1. Open a classic PCAP or a basic single-interface Ethernet PCAPNG file.
2. Narrow the evidence by protocol, endpoint, packet number, time range, or text.
3. Inspect decoded fields and raw bytes before changing anything.
4. Preview keep/drop decisions, timing changes, fixed-length byte edits, or supported L2-L4 rewrite rules.
5. Select the full or subset artifact and review its bounded privacy exposure inventory for visible IPv4, IPv6, MAC, DNS, HTTP Host, TLS SNI, and printable payload or unknown content.
6. Review export scope, checksum behavior, and unresolved privacy warnings.
7. Export a new classic PCAP; the source capture is not overwritten.

When to use PCAP Surgery

• A Tier-3 support case contains a large capture but only one flow or failure window matters.
• A network product QA team needs a deterministic regression fixture with selected endpoints, ports, timing, or packet scope changed.
• You need a visual impact preview before applying repeatable transformations.
• You need supported IPv4/TCP/UDP header rewrites to carry corresponding checksum repairs.
• You need a selected-artifact inventory of visible privacy exposure before deciding what requires deeper manual review.

When to use something else

• Live capture: use tcpdump or Wireshark
• Deep protocol analysis: use Wireshark's full protocol dissectors
• Command-line batch processing: use editcap, tcpdump, or tshark
• Complete anonymization or payload redaction: use a fail-closed sanitization workflow and verify every supported protocol
• Multi-interface or metadata-rich PCAPNG preservation: use a tool that preserves the required PCAPNG blocks and interface model

Important limits before export

• The privacy exposure inventory is deliberately partial. It does not decrypt traffic, reassemble streams, or issue a safe-to-share verdict.
• IPv4 header masking does not remove identifiers from payloads, DNS names, HTTP fields, TLS SNI, credentials, IPv6, or unknown protocols.
• Fixed-length raw byte edits do not automatically repair checksums.
• Arbitrary payload stripping, packet truncation, and capture splitting are not supported in the current release.
• Export writes classic PCAP. The app does not currently re-open the exported file automatically or generate a transformation manifest.
• Re-open important outputs in a trusted parser and perform a separate privacy review before external sharing.