Hello, I’m using command "zeek -i -w " to save my traffic to the .trace file and analyze it. Due to the storage overhead, I want to drop the payload of the packet I capture. However I have no idea how to do it :(. Could anyone help me?
Thank you so much ;}
maybe piping the pcap through scapy would work for you? Here’s a stackoverflow link. Note, that Zeek will not be immensely happy once you do that. Feel free to chime in on the following issue: