First time here? Check out the FAQ!

THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.

mask gsm_sms.sms_text content

mask
tshark
gsm_sms
retag add tags

Hi, I have a pcap/pcapng that I like to replace the gsm_sms.sms_text data with '*' using tshark. keep the pcap length but hide the content.

I understand dissector code change is required but I have no idea where.

It should support fragmented messages.

Yaniv

asked 2023-03-09 18:24:23 +0000

edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

Be the first one to answer this question!

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer

mask gsm_sms.sms_text content edit

Comments

Be the first one to answer this question!

mask gsm_sms.sms_text content