Ask Your Question

Revision history [back]

click to hide/show revision 1
initial version

It looks like you're using Windows, in which case there is no preinstalled "uniq" command. What you could do is use Powershell, which should be available, in which case your command could look like this:

C:\Users\long>wireshark\tshark -i ethernet -T fields -e ip.src | Group-Object | Where-Object count -eq 1 | Select-Object -Expand Group

Though I might add that this won't probably work during live capture (which is the same for using uniq and sort, because it needs a full scan over the complete set to determine duplicates), but it works while reading an exsting PCAPng file from disk via -r parameter.