// the find
theclam/stripe
Performs IP reassembly and strips off extraneous encapsulation (VLANs, MPLS, GRE, L2TP) in pcap files
A single-file C tool that strips tunnel/encapsulation headers (VLANs, MPLS, GRE, L2TP, GTP, VXLAN, ERSPAN) from pcap files and reassembles IP fragments, leaving plain Ethernet payload. Aimed at network engineers doing packet analysis with tools that choke on encapsulated captures.
Single .c file with no dependencies beyond libpcap — you can audit the entire thing in an afternoon. Covers a genuinely annoying gap: Wireshark dissects these protocols fine but many analysis tools don't, and converting captures by hand is tedious. IP fragment reassembly handling is included, which is the hard part most similar tools skip. Pre-built binaries for Mac (both architectures) and Windows are included in the repo for field use without a build environment.
Only reads legacy pcap format — no pcapng support, so captures from modern Wireshark require a conversion step first. Error handling is minimal for a C tool processing untrusted binary input; malformed or fuzzed pcap files could easily trigger undefined behavior. ERSPAN Type II is the only tested variant despite claiming Type I and III support — that disclaimer buries a real reliability risk. At 60 stars and a single maintainer, there's no test suite and no CI, so regressions ship silently.