Standard view
What is SCRUB-tcpdump?
SCRUB-tcpdump is a set of functions that are used to anonymize a packetflow trace in libpcap or tcpdump format
so that it can be used to collaborate or release without jeapordizing the anonymity of the network represented by
the capture flow. SCRUB-tcpdump allows the user to select from a variety of options for anonymizing fields like
the ports, IP addresses, time-stamps, transport protocols, flags, options, etc. For more information on how to
download and use SCRUB-tcpdump see our Download page. If you would like to see the results
of studies about SCRUB-tcpdump and its impacts and uses in security analysis, please see Papers
and read about it there.
Version 0.1 now released
We have now released Version 0.1 of our software. Pick it up from the link on the download
page. It is not pretty to build (you will need libpcap's dev files and the basic netinet headers) installed to
a "sane" location, but the included Makefile has been tested on Solaris, Mac OS X and two different Linuxes
without a problem. Windows support is unknown, but also unlikely with this release. Hopefully a future release
will allow that support.
Release Update
We have nearly copmleted an internal-alpha of the project and are now awaiting final approval and testing on
it before we package up a public alpha of the release. We have also begun working towards an initial release
of the project as a patch set for the standard tcpdump sources. Stay tuned for upcoming news!
Current Work
Our current goal is to wrap up the stand-alone version of the code as soon as possible and we will then be working
on updates to the speed of the code in certain areas. We are also in the beginnings of a port to the standard
TCPDump tree and will be releasing the code in both forms as soon as we are able to. That will allow in-place
capture and anonymization of datasets with the same tool, while still allowing the functionality of anonymizing
exsiting capture files. Our speed optimizations will be key to making this in-place anonymization viable.