Find & Replace¶
Available since version 1.2
When you are working with a large number of streams, e.g. after a PCAP import where each packet is imported as a separate stream, it can be cumbersome to edit each stream individually.
You can bulk-edit multiple streams by using find & replace just like you do in a word-processor.
For example, the values above will change the streams as follows -
if udp.destination_port == 16920: udp.destination_port = 7251
Almost all fields of all protocols natively supported by Ostinato can be used with Find & Replace
If you want to rewrite a protocol field irrespective of it's original value, use Match any value -
Example: The values above will change the VLAN id to
1974 for all streams containing a vlan.
For more complex match and replace, you can specify find & replace masks.
A find (or match) is successful if,
(FieldValue & FindMask) == FindValue
A replace mask works as follows,
NewFieldValue = (OldFieldValue & ~ReplaceMask) | (ReplaceValue & ReplaceMask)
Example: The values above will change the streams as follows (
X is don't care,
V is original value) -
if ipv4.source == 10.6.X.100: ipv4.source = 192.168.V.52
If you want to rewrite destination MAC addresses, but you want to skip broadcast and multicast mac addresses, you can use a find mask to check the LSB of the first byte is 0 - this bit is 0 for unicast addresses and 1 for multicast/broadcast mac addresses as per the spec
Find Mask = 01:00:00:00:00:00
Find Value = 00:00:00:00:00:00
By default, the find & replace is performed across all streams configured on the port. To restrict the operation only to a subset of streams, check the Selected Streams Only option. This option is enabled only if you have selected one or more streams.