CODEWITHSUNDEEP
pythonwiresharkpcaptshark
drowningincode
drowningincode

Reputation: 1225

Get all ips in PCAP file

I have a set of PCAP files and I need to retrieve all the ips. I found this link and have currently been using this command.

tshark_path + " -r " + infile + " -T fields -e ip.dst | sort | uniq

The problem is this seems to be very slow and also occasionally returns something that looks like this: 128.219.232.12,10.78.0.131. My question is if there is a better way to do this that will run quicker and be more accurate.

Also noteworthy, my code is in python.

Upvotes: 2

Views: 5780

Answers (2)

Charlie
Charlie

Reputation: 11

Open Command prompt and go to tshark directory, for example:

cd C:\Program Files\Wireshark

tshark -nr input.pcap -T fields -e ip.src -e ip.dst -E separator=, > ouput.csv

Here you have to provide input.pcap file with directory and you will get output in CSV format.

Upvotes: 1

user684451
user684451

Reputation:

Take a look at TShark Statistics:

tshark -r test.pcapng -q -z ip_hosts,tree

Upvotes: 5

Related Questions