Revision history [back]

You tshark with the -z endpoints,<type> option, setting type appropriately, e.g. "ip" for IPv4 addresses. You'll also need the -q and -n flags to suppress normal output and disable name resolution respectively, e.g.

 tshark -r mycapture.pcap -q -n -z endpoints,ip

You may find that using tshark you can enable name resolution and the load won't be too bad by removing the -n option.

See the tshark man page for all the -z endpoints,... options.

You To get the IPs, use tshark with the -z endpoints,<type> option, setting type appropriately, e.g. "ip" for IPv4 addresses. You'll also need the -q and -n flags to suppress normal output and disable name resolution respectively, e.g.

 tshark -r mycapture.pcap -q -n -z endpoints,ip

You may find that using tshark you can enable name resolution and the load won't be too bad by removing the -n option.

See the tshark man page for all the -z endpoints,... options.