ANT Packet Processing

dag scrubber

Dag Scrubber is our tool for scrubbing packets of user data and optionally doing IP address anonymization. It supports both pcap and ERF format ("dag", giving the legacy name).

About Dag_scrubber

DAG scrubber anonymizes network packet traces.

Input formats are pcap and ERF (“dag”) format.

It can do the following kinds of scrubbing:

All are optional.

Sample Use Cases

To use it, first we generate a random key (used for any anonymization):

./dag_scrubber -m -s test.keyfile

Then to process pcaps of DNS traffic (only), anonymization IP addresses and preserving payloads, do:

./dag_scrubber -P -m -s ./test.keyfile -n 'port 53' --pass4=24 --pass6=96

Where the options are to specify pcap input (-P), scramble MAC addresses (-m), use the keyfile we just generated (-s ./test.keyfile), filter traffic for just dns (-n 'port 53'), and anonymize only the low 8 bits of IPv4 and low 32 bits of IPv6 (--pass4=24 --pass6=96).