Find & Replace¶

Available since version 1.2

When you are working with a large number of streams, e.g. after a PCAP import where each packet is imported as a separate stream, it can be cumbersome to edit each stream individually.

You can bulk-edit multiple streams by using find & replace just like you do in a word-processor.

Find & Replace protocol fields

For example, the values above will change the streams as follows -

if udp.destination_port == 16920:
    udp.destination_port = 7251

Info

Almost all fields of all protocols natively supported by Ostinato can be used with Find & Replace

Match Any¶

If you want to rewrite a protocol field irrespective of it's original value, use Match any value -

Rewrite protocol fields

Example: The values above will change the VLAN id to 1974 for all streams containing a vlan.

Masks¶

For more complex match and replace, you can specify find & replace masks.

A find (or match) is successful if,

(FieldValue & FindMask) == FindValue

A replace mask works as follows,

NewFieldValue = (OldFieldValue & ~ReplaceMask) | (ReplaceValue & ReplaceMask)

Flexible Find & Replace protocol fields using mask

Example: The values above will change the streams as follows (X is don't care, V is original value) -

if ipv4.source == 10.6.X.100:
    ipv4.source = 192.168.V.52

Skip broadcast/multicast

If you want to rewrite destination MAC addresses, but you want to skip broadcast and multicast mac addresses, you can use a find mask to check the LSB of the first byte is 0 - this bit is 0 for unicast addresses and 1 for multicast/broadcast mac addresses as per the spec

Find Mask = 01:00:00:00:00:00
Find Value = 00:00:00:00:00:00

Scope¶

By default, the find & replace is performed across all streams configured on the port. To restrict the operation only to a subset of streams, check the Selected Streams Only option. This option is enabled only if you have selected one or more streams.