One of the most common questions we receive from security teams is: “Can I safely share a capture that contains internal IP addresses and application credentials?” Until now, the answer required manual editing in hex editors or running custom Python scripts before uploading. Today, that changes.
NetNerve's new Zero-Trust PCAP Anonymizer runs entirely in your browser's volatile memory. Your original capture file never leaves your device. It is sanitized, anonymized, and only then submitted for analysis — or exported as a clean artifact for sharing with your team.
The Problem: PCAP Files Are Sensitive
A raw packet capture can contain far more than just network metadata. HTTP sessions may include authentication tokens and plaintext passwords. Internal DNS queries reveal your private subnet structure. Application layer payloads can expose database queries, API responses, and PII. Sharing or uploading such a file — even to a trusted analysis platform — is a compliance risk.
This is especially acute for enterprises operating under GDPR, HIPAA, or PCI-DSS. Many security teams have to simply forgo cloud analysis tools because they cannot risk a raw capture transiting the internet.
How the Sanitizer Works
The sanitizer is a pure binary PCAP processor written in TypeScript and executed in the browser via the Web Crypto ArrayBuffer API. It reads your .pcap or .cap file directly into a Uint8Array, walks the packet records frame-by-frame, applies the selected transformations, and outputs a new ArrayBuffer — all without touching the filesystem or making a network request.
IP Obfuscation
Internal RFC 1918 addresses (10.x, 172.16.x, 192.168.x, 127.x) are deterministically remapped to RFC 5737 documentation ranges. The same IP always maps to the same anonymous address, preserving flow relationships without revealing topology.
Payload Stripping
L5+ application data is zeroed out with 0x00 bytes, while Ethernet, IPv4, TCP, and UDP headers are preserved intact. IPv4 and TCP/UDP checksums are automatically recalculated to keep the file valid.
MAC Anonymization
Hardware Ethernet MAC addresses can be masked with IANA-reserved anonymized OUIs, preventing device fingerprinting from Ethernet layer data in the capture.
Checksum Integrity — A Critical Detail
Most naive anonymization tools forget one thing: modifying IPs or zeroing payloads invalidates the packet's checksums. A Wireshark import or an IDS engine will reject packets with bad checksums as malformed. Our sanitizer recalculates both the IPv4 header checksum and the TCP/UDP pseudo-header checksum after every modification, producing a capture file that is structurally valid and will load cleanly in any packet analysis tool.
Technical note: The sanitizer supports both big-endian (0xa1b2c3d4) and little-endian (0xd4c3b2a1) PCAP magic numbers, including nanosecond-precision variants. PCAPNG format (0x0a0d0d0a) captures are routed to the server-side Forensics Engine automatically.
Two Modes: Export or Analyze
After selecting your sanitization options, you have two paths:
Download Clean .PCAP
Exports the sanitized capture as a sanitized_[filename].pcap file directly to your device. Use this to safely share captures with vendors, red teams, or auditors. The download happens entirely in the browser — no server involved.
Sanitize & Analyze
Applies the sanitization in memory and immediately submits the clean capture to the NetNerve AI and Suricata IDS pipeline. You get full threat analysis on the sanitized file — your original capture stays on your device.
A Forensics Tier Feature
The PCAP Anonymizer is available exclusively to Forensics tier subscribers. This tier was designed for security professionals, incident responders, and enterprise teams who require the deepest levels of privacy control and compliance guarantees. At $14.99/mo, it includes the full in-memory sanitization suite, payload stripping, MAC anonymization, and access to the server-side Forensics Engine for PCAPNG captures.
The Bottom Line
You should never have to choose between getting an AI-powered threat analysis and protecting your network's sensitive data. The Zero-Trust PCAP Anonymizer is our answer to that tradeoff.
Sanitize in your browser. Analyze with confidence. Share without fear.