How to resolve a large list of IP addresses?

asked 2021-07-08 14:53:44 +0000

neverxxsleep
1 ●1 ●1 ●2

Hi. I have files with a lot of captured traffic which I want to analyse. But when I use Wireshark, turning on "Resolving addresses" it is working very slow, program starts lagging, etc. So I can't to analyse a list of Endpoints where I was connecting.

So I supposed I should try to resolve IP addresses in another way. I want to copy all IPs from Statistics -> Endpoints -> IPv4 and resolve this list in any different ways. I guess it should be much faster (because I already tried to analyse my dumps in another PC, another system and it is still lagging so much) and more efficient. So, could you please give a hint how could I export all Endpoints IPv4 addresses and resolve it as fast as possible.

edit retag flag offensive close merge delete

add a comment

answered 2021-07-08 15:33:51 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●974 ●227 https://www.wireshark.org

updated 2021-07-08 15:36:36 +0000

To get the IPs, use tshark with the -z endpoints,<type> option, setting type appropriately, e.g. "ip" for IPv4 addresses. You'll also need the -q and -n flags to suppress normal output and disable name resolution respectively, e.g.

 tshark -r mycapture.pcap -q -n -z endpoints,ip

You may find that using tshark you can enable name resolution and the load won't be too bad by removing the -n option.

See the tshark man page for all the -z endpoints,... options.

edit flag offensive delete link

Comments

Thank you! It helped me so much. It is exporting and resolving much faster than earlier. But could you please prompt me what can I do with not resolved IPv4 addresses? Are there any methods so I could upload a list of IP addresses that not resolved (maybe there any programs or sites) and get it resolved? I am fully newbie in this, and I find it difficult to understand something from documentation. It's great that Wireshark has such pretty good support :)

neverxxsleep ( 2021-07-08 22:55:38 +0000 )edit

Wireshark uses a resolver library, c-ares to resolve IP addresses to names and it will use the DNS servers set in the Name Resolution preferences. I think that if that list is empty it uses the host DNS config to find DNS servers.

If IP's can't be resolved then either the query is being sent to the wrong DNS servers (i.e. the IP's are internal (non-public) so you need to use an internal DNS server or there is indeed no DNS reverse record for them.

Can you give an example of one IP that doesn't resolve?

grahamb ( 2021-07-09 07:51:45 +0000 )edit

add a comment

How to resolve a large list of IP addresses?

1 Answer

Comments

Your Answer

Question Tools

Stats

How to resolve a large list of IP addresses? edit

1 Answer

Comments

Your Answer

Question Tools

Stats

How to resolve a large list of IP addresses?