1 | initial version |
You tshark with the -z endpoints,<type>
option, setting type appropriately, e.g. "ip" for IPv4 addresses. You'll also need the -q
and -n
flags to suppress normal output and disable name resolution respectively, e.g.
tshark -r mycapture.pcap -q -n -z endpoints,ip
You may find that using tshark you can enable name resolution and the load won't be too bad by removing the -n
option.
See the tshark man page for all the -z endpoints,...
options.
2 | No.2 Revision |
You To get the IPs, use tshark with the -z endpoints,<type>
option, setting type appropriately, e.g. "ip" for IPv4 addresses. You'll also need the -q
and -n
flags to suppress normal output and disable name resolution respectively, e.g.
tshark -r mycapture.pcap -q -n -z endpoints,ip
You may find that using tshark you can enable name resolution and the load won't be too bad by removing the -n
option.
See the tshark man page for all the -z endpoints,...
options.