
tcptrunc v0.1
December 2016

Mark Allman
International Computer Science Institute
mallman@icir.org

This utility removes the payload bytes that appear after the
transport header from pcap packet traces.


Basic usage:

  usage: tcptrunc [options]
       -h        usage instructions
       -r file   input packet trace (default: stdin)
       -s        skip non-UDP and non-TCP packets
       -w file   output packet trace (default: stdout)
       -v        version information

Default behavior:

  - By default the tool reads a packet trace from stdin and writes
    the new (payload-less) trace on stdout.  This can be changed
    with the -r and -w options.

Options:

  - Currently the only packets the tool knows how to strip the
    payload from UDP and TCP packets.  By default, all other packets
    are simply written to the output trace as they appear in the
    input trace.  Using the "-s" option skips packets that are not
    UDP or TCP as these packets may contain sensitive payload that
    tcptrunc does not know how to remove.

Building:

  - The tool requires libpcap be installed.

  - The tool was developed under OSX and Linux.  Running "make" will
    build tcptrunc on either of these.

  - Yes, I am too stupid to use autoconf.  Or, maybe, too smart.
    You can decide!

  - Please let me know if you have tweaks or comments.

Acknowledgments:

  - This tool borrows code from my tcpsplit tool.

  - I used Ethan Blanton's tcpurify tool to remove payload data from
    traces for eons.  When a bug bit me I decided to roll something
    less complex than tcpurify---which has many additional features.
    While tcptrunc does not use code from tcpurify, I used tcpurify
    as a guide and it follows the general game plan Ethan used.
    (I'd have stolen the code directly, but it didn't quite mesh
    with the tcpsplit code I did steal.)
