Cutting-Edge Packet Manipulation Tool

A Comprehensive CLI Utility for Editing, Transforming, and Analyzing PCAP Network Traffic.

A Product by Netomize

PacketSmith

Unlock advanced network manipulation and detection with PacketSmith. Perform intricate header edits, analyze streams, replace layers,  scan packets, and inject packets with precision—all from your command line.

Features at a Glance

It offers comprehensive support for a specific set of network protocols, from data link to transport layers, enabling users to perform complex modifications.

Features include checksum correction for various protocols, frame deletion, advanced IPv4/IPv6 header editing, TCP/UDP streams analysis, protocol layer manipulation (converting UDP/TCP-to-TCP/UDP, IPv4/IPv6-to-IPv6/IPv4), TCP handshake and DNS packet injection, frame fragmentation, source/destination address and port modification, and detailed PCAP statistical analysis, among others.

Designed for Your Needs

PacketSmith: Expert-built to solve your toughest PCAP manipulation challenges. Whether you’re reverse engineering a network protocol or fuzzing a network stack, testing an IDS/IPS, fixing/editing C&C traffic pcap, or anonymizing data, our security and network researchers have developed this robust tool independently, from the ground up, with zero external dependencies, to provide you with the precise control you need.

Check the Features/Supported Protocols pages for more information.

How PacketSmith Compares

PacketSmith combines capabilities that would otherwise require multiple specialized tools, making packet analysis, editing, transformation, and detection available in a single platform.

Feature PacketSmith Wireshark Scapy tcprewrite Ostinato Packet Crafter
PCAP Header Analysis ✔ ✔ Scripted ✖ ✖ ✖
PCAP Statistical Analysis ✔ Limited Scripted ✖ ✖ ✖
Flow Analysis ✔ ✔ Scripted ✖ ✖ ✖
Entropy Calculation ✔ ✖ Scripted ✖ ✖ ✖
TCP/UDP Stream Analysis ✔ ✔ Scripted ✖ ✖ ✖
TCP Stream Reassembly ✔ ✔ Manual ✖ ✖ ✖
Extract Reassembled TCP/UDP Payloads ✔ Manual Scripted ✖ ✖ ✖
IPv4 Header Modification ✔ ✖ ✔ ✔ Partial ✔
IPv6 Header Modification ✔ ✖ ✔ Partial Partial Partial
MAC / IP / Port Replacement ✔ ✖ ✔ ✔ Partial ✔
Automatic Checksum Correction ✔ ✖ Manual ✔ ✔ ✔
Delete Frames From PCAP ✔ ✖ Scripted ✖ ✖ Limited
TCP Sequence/Acknowledgement Recalculation ✔ ✖ Manual ✖ ✖ ✖
IPv4 ↔ IPv6 Conversion ✔ ✖ Manual ✖ ✖ ✖
TCP ↔ UDP Stream Conversion ✔ ✖ Custom Code ✖ ✖ ✖
TCP Handshake Generation ✔ ✖ Scripted ✖ Partial Partial
TCP FIN Handshake Injection ✔ ✖ Manual ✖ ✖ ✖
DNS Query Injection ✔ ✖ ✔ ✖ ✖ Partial
DNS Response Injection ✔ ✖ ✔ ✖ ✖ Partial
VLAN Insertion / Removal ✔ Decode Only Manual ✖ Partial Partial
VXLAN Encapsulation / Removal ✔ Decode Only Manual ✖ Partial ✖
GTP-U Decapsulation ✔ Decode Only Manual ✖ ✖ ✖
IPv4 Fragmentation ✔ Reassembly Only Manual ✖ ✖ Partial
IPv6 Fragmentation ✔ Reassembly Only Manual ✖ ✖ Partial
Fragment Detection and Reassembly ✔ ✔ Manual ✖ ✖ Partial
ICMP Echo Stream Reconstruction ✔ ✖ ✖ ✖ ✖ ✖
ICMP Tunnel Detection ✔ ✖ ✖ ✖ ✖ ✖
TLS X.509 Certificate Extraction ✔ ✔ Manual ✖ ✖ ✖
DTLS X.509 Certificate Extraction ✔ Limited Manual ✖ ✖ ✖
Payload Anonymization ✔ ✖ Scripted Partial ✖ ✖
Search & Replace With Packet Integrity Preservation ✔ ✖ Scripted ✖ ✖ Limited
YARA-X Integration ✔ ✖ ✖ ✖ ✖ ✖
Protocol-Aware YARA Identifiers (PaIDs) ✔ ✖ ✖ ✖ ✖ ✖
YARA Flow Correlation (flow_state / track_state) ✔ ✖ ✖ ✖ ✖ ✖
AMSI Scanning ✔ ✖ ✖ ✖ ✖ ✖
JSON Output ✔ Partial Scripted ✖ ✖ Partial
CLI Automation ✔ Limited ✔ ✔ Partial Partial