Ask Your Question

Revision history [back]

Why are there two ip addresses in the ip.src field?

I have some pcap files that I am processing with this command:

tshark -T fields -E header=y -e ip.src -e ip.dst

Results are mostly from private network space, but many entries have two ip addresses in the src and dst fields, example below. What does this mean?

ip.src                                ip.dst,,