 | 1 | initial version |  |
You tshark with the -z endpoints,<type> option, setting type appropriately, e.g. "ip" for IPv4 addresses. You'll also need the -q and -n flags to suppress normal output and disable name resolution respectively, e.g.
tshark -r mycapture.pcap -q -n -z endpoints,ipYou may find that using tshark you can enable name resolution and the load won't be too bad by removing the -n option.
See the tshark man page for all the -z endpoints,... options.
| | 2 | No.2 Revision |
You To get the IPs, use tshark with the -z endpoints,<type> option, setting type appropriately, e.g. "ip" for IPv4 addresses. You'll also need the -q and -n flags to suppress normal output and disable name resolution respectively, e.g.
tshark -r mycapture.pcap -q -n -z endpoints,ipYou may find that using tshark you can enable name resolution and the load won't be too bad by removing the -n option.
See the tshark man page for all the -z endpoints,... options.