TRACEANON(1)

👑 TRACEANON 👑 (section 1 of the manual, user commands, iykyk)

okay so bestie. you know how traces are full of real actual IP addresses and you cannot just be posting those in the group chat? yeah. that's this. traceanon is the girl who blurs out everyone's faces before the video goes up. 💅

---

✨ NAME ✨

traceanon — anonymise ip addresses of traces

---

🎀 SYNOPSIS 🎀

traceanon [ -s | --encrypt-source ] [ -d | --encrypt-dest ] [ -p prefix
| --prefix=prefix ] [ -c key | --cryptopan=key ] [ -f key-file |
--keyfile=file ] [ -z level | --compress-level=level ] [ -Z method |
--compress-type=method ] sourceuri desturi

---

🦋 DESCRPTION 🦋

(yes it's spelled like that, we don't talk about it, it's iconic, leave her alone 💖)

so basically traceanon takes a trace and anonymises it. it replaces the IP addresses hanging out in the IP header, plus any embedded packets tucked inside an ICMP packet. and because it's not a monster, it also fixes the checksums inside TCP and UDP headers afterwards, so everything still adds up. 🫶

there are two anonymisation schemes, and you get to pick your fighter:

• the first one swaps a prefix for another prefix. lowkey the classic move — say you wanna replace a /16 with the equivilent prefix from RFC1918. done.
• the other one is cryptopan, which is a prefix preserving encryption scheme based on AES. she's fancy. 👑

---

⭐ the options ⭐

• -s, --encrypt-source — encrypt only source ip addresses.
• -d, --encrypt-dest — encrypt only destination ip addresses.
• -p, --prefix=prefix — substitute the high bits of the IP addresses with the provided prefix.
• -c, --cryptopan=key — encrypt the IP addresses using the prefix-preserving cryptopan method using the key key. the key can be up to 32 bytes long, and will be padded with NULL characters.
• -f, --keyfile=file — encrypt the IP addresses using the prefix-preserving cryptopan method using the key specified in the file file. the key must be 32 bytes long. a suitable method of generating a key is by using the command dd to read from /dev/urandom. (do it. it's giving secure. 🎀)
• -z, --compress-level=level — compress the output trace using a compression level of level. compression level can range from 0 (no compression) through to 9. higher compression levels require more CPU to compress data. defaults to no compression.
• -Z, --compress-type=method — compress the output trace using the compression algorithm method. possible algorithms are "gzip", "bzip2", "lzo", "xz" and "none". default is "none".

---

🌸 EXAMPLES 🌸

look at her go. no notes. 😭

traceanon --cryptopan="fish go moo, oh yes they do" \
     --encrypt-source \
     --encrypt-dest \
     --compress-level=1 \
     --compress-type=gzip \
     erf:/traces/unenc.gz \
     erf:/traces/enc.gz \

---

💀 BUGS 💀

not me exposing the flaws but okay, honesty hour:

• this software should support encrypting based on the direction/interface flag. (it does not. bestie it simply does not. 🙈)
• IP addresses inside ARP's are not encrypted.

---

🌈 LINKS 🌈

more details about traceanon (and libtrace) can be found at http://www.wand.net.nz/trac/libtrace/wiki/UserDocumentation

---

👑 SEE ALSO 👑

libtrace(3), tracemerge(1), tracefilter(1), traceconvert(1), tracestats(1), tracesummary(1), tracertstats(1), tracesplit(1), tracesplit_dir(1), tracereport(1), tracepktdump(1), tracediff(1), tracereplay(1), traceends(1), tracetopends(1)

---

💜 AUTHORS 💜

Perry Lorier <perry@cs.waikato.ac.nz>

---

and that's the whole vibe check bestie 🧚 this page is from traceanon (libtrace), dated October 2005, and lives in section 1 of the manual — she's old, she's iconic, she's still out here protecting your IPs. periodt. 💖✨🎀