A Wireshark plugin for real-time anonymization and cloaking of sensitive packet data directly in the Wireshark GUI.
💡 Key Feature: Cloak sensitive data in real-time without modifying the original PCAP file. Perfect for screen sharing, demos, training, and presentations.
- 🔒 Three Cloaking Modes - OFF, CLOAK_DATA (payloads only), CLOAK_ALL (addresses + payloads)
- 🎯 Real-time Anonymization - Toggle cloaking on/off instantly with keyboard shortcuts
- 🔄 Conversation Flow Preservation - Same IPs map to same anonymized IPs across packets
- 🌐 IPv4 & IPv6 Support - Full support for both IP versions
- 💻 MAC Address Cloaking - Anonymizes MAC addresses while maintaining device identity
- 🎨 Visual Indicators - Clear [CLOAKED] markers in Info column
- ⚡ Fast Performance - Post-dissector architecture for efficiency
- 📁 PCAP Preservation - Original capture files remain unchanged
- ⌨️ Keyboard Shortcuts - Quick mode toggling (configurable)
- 🚀 Wireshark Integrated - Pure Lua implementation running directly from Wireshark
Access the plugin from the Wireshark menu:
Tools → PacketCloak → Toggle CLOAK_ALL
Note: Add screenshots showing before/after cloaking modes
Platform-specific installation:
macOS/Linux:
git clone https://github.com/yourusername/PacketCloak.git
cd PacketCloak
./install.shManual installation:
# macOS/Linux
cp PacketCloak.lua ~/.local/lib/wireshark/plugins/
# Windows
copy PacketCloak.lua %APPDATA%\Wireshark\plugins\- Load a capture file in Wireshark or start live capture
- Configure shortcuts (optional): Edit → Preferences → Shortcuts, search for
PacketCloak - Toggle mode: Tools → PacketCloak → Toggle CLOAK_ALL (or use keyboard shortcut)
- Reload capture: Press Ctrl+R (Cmd+R on macOS) to apply changes
- Verify cloaking: Look for
[CLOAKED]prefix in Info column
See QUICKSTART.md for detailed guide.
Normal Wireshark operation with no anonymization.
Best for: Regular analysis when privacy isn't a concern
Anonymizes payload data only; IP and MAC addresses remain visible.
What gets cloaked:
- TCP, UDP, ICMP payloads
- Raw packet data
What stays visible:
- IP addresses (source and destination)
- MAC addresses
- Port numbers and protocol headers
Best for: Hiding sensitive application data while showing network topology
Anonymizes both addresses AND payload data for maximum privacy.
What gets cloaked:
- IPv4 addresses → Mapped to 10.0.0.0/8 range
- IPv6 addresses → Mapped to fd00::/8 range
- MAC addresses → Mapped to 02:00:00:00:00:XX range
- TCP/UDP/ICMP payloads
- ARP addresses
What stays visible:
- Port numbers
- Protocol types
- Packet timing and sizes
- TCP flags and sequence numbers
Best for: Maximum privacy during demos, training, or sharing captures
- QUICKSTART.md - 5-minute getting started guide
- USAGE.md - Comprehensive usage guide with examples
- PROJECT_SUMMARY.md - Architecture and technical details
- CHANGELOG.md - Version history
- Wireshark 3.0 or later (includes Lua 5.1+)
- macOS: 10.14+
- Linux: Ubuntu, Fedora, Arch, Debian
- Windows: 10+
Live Demo with Sensitive Data:
# Scenario: Presenting Wireshark capture on a video call
# Solution: Enable CLOAK_ALL mode before sharing screen
Tools → PacketCloak → Toggle CLOAK_ALL
Ctrl+R (reload)Training Session:
# Scenario: Teaching network analysis with real captures
# Solution: Enable CLOAK_DATA to show topology, hide data
Tools → PacketCloak → Toggle CLOAK_DATA
Ctrl+R (reload)Screenshot for Documentation:
# Scenario: Creating public documentation
# Solution: Toggle CLOAK_ALL, take screenshot, toggle back
Tools → PacketCloak → Toggle CLOAK_ALL
Ctrl+R (reload)
[Take screenshots]
Tools → PacketCloak → Toggle CLOAK_ALL (to disable)- Language: Pure Lua 5.1/5.2
- Lines of Code: ~350
- Implementation: Post-dissector pattern
- State Management: Global mappings for IP/MAC anonymization
- Performance: Efficient packet processing with minimal overhead
- Compatibility: Works with all Wireshark dissectors
- Screen Sharing & Demos - Present captures without exposing sensitive data
- Training & Education - Teach network analysis with real-world captures safely
- Documentation - Create screenshots and guides without revealing infrastructure
- Third-Party Analysis - Share captures with consultants while protecting privacy
- Security Reviews - Analyze traffic patterns without exposing actual addresses
Check installation:
ls -la ~/.local/lib/wireshark/plugins/PacketCloak.luaVerify in Wireshark:
- Help → About Wireshark → Plugins
- Look for "PacketCloak.lua" in the list
Reload plugins:
- Press Ctrl+Shift+L (Cmd+Shift+L on macOS)
Solution: Press Ctrl+R (Cmd+R on macOS) to reload the capture after changing modes.
For large captures:
- Apply display filters first to reduce packet count
- Use CLOAK_DATA instead of CLOAK_ALL (less processing)
- Close other applications to free memory
Customize anonymization by editing PacketCloak.lua:
local SANITIZED_PATTERN = 0x5341 -- "SA" for Sanitized
local BASE_IP = "10.0.0.0" -- Base IP for anonymization
local BASE_MAC_PREFIX = "02:00:00:00:00" -- Base MAC prefix- Cloaking is display-only; exported PCAPs retain original data
- Mode changes require capture reload (Ctrl+R) to apply
- Performance may be affected on very large captures (>100K packets)
- Some protocol-specific fields may not be fully cloaked
- IGMP packets are preserved for analysis purposes
GNU General Public License v2 - see LICENSE file for details.
This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version.
- Wireshark development team for excellent Lua API
- Inspired by PacketSanitizer project
- Network analysis community for feedback and suggestions
- 🐛 Issues: GitHub Issues
- 📚 Documentation: See docs in this repository
- ✨ Contributing: Contributions welcome! Please open issues or pull requests
- PacketSanitizer - Python/Scapy tool for creating sanitized PCAP files (permanent anonymization)
Built with ❤️ for the network analysis community