Dag Scrubber is our tool for scrubbing packets of user data and optionally doing IP address anonymization. It supports both pcap and ERF format ("dag", giving the legacy name).
DAG scrubber anonymizes network packet traces.
Input formats are pcap and ERF (“dag”) format.
It can do the following kinds of scrubbing:
All are optional.
To use it, first we generate a random key (used for any anonymization):
./dag_scrubber -m -s test.keyfile
Then to process pcaps of DNS traffic (only), anonymization IP addresses and preserving payloads, do:
./dag_scrubber -P -m -s ./test.keyfile -n 'port 53' --pass4=24 --pass6=96
Where the options are to specify pcap input (-P),
scramble MAC addresses (-m),
use the keyfile we just generated (
filter traffic for just dns (
-n 'port 53'),
and anonymize only the low 8 bits of IPv4 and low 32 bits of IPv6