 | 1 | initial version |
I'm trying to look for a potential duplicate MAC Address.
You might want to use tshark along with other CLI tools to help with this? For example:
tshark -r file.pcapng -Y "eth.addr[0:3] == 00:04:f2" -T fields -e eth.src -e ip.src > eth_addr.txt
tshark -r file.pcapng -Y "eth.addr[0:3] == 00:04:f2" -T fields -e eth.dst -e ip.dst >> eth_addr.txt
sort eth_addr.txt | uniq -c