I find Wiresharks Endpoint statistics very interesting and would like to extract them in a more automated fashion without needing to use the wireshark GUI.
TL;DR: can i get the Endpoint statistics with Maxmind GeoIP via commandline?
I can easily extract the endpoints using e.g.
tshark -r infile.pcap -z conv,ip -w outfile.pcap
and it will print me the statistics like this
IPv4 Conversations
Filter:<No Filter>
| <- | | -> | | Total | Relative | Duration |
| Frames Bytes | | Frames Bytes | | Frames Bytes | Start | |
192.168.101.35 <-> encrypted-tbn1.gstatic.com 47186 68 MB 11439 772 kB 58625 69 MB 72,370211000 266467,3920
192.168.101.141 <-> rr3.sn-4g5e6nz7.gvt1.com 49431 63 MB 4978 387 kB 54409 64 MB 100121,935270000 8,6585
192.168.101.141 <-> app-measurement.com 42865 62 MB 10943 770 kB 53808 63 MB 143553,721566000 130918,2853
...
However, the GUI allows the name resolution to be enabled and it will also show me the GeoIP and AS information I retrieved form MaxMind.
tshark -v does show with MaxMind and tshark -G folders shows the correct path.
Also i can use something like this (which i copied from some bug report)
tshark -r traffic.pcap -T fields -e frame.number -e ip.src -e ip.geoip.src_country -e ip.dst -e ip.geoip.dst_country -e ip.geoip.asnum
And it will show the GeoIP information as I'd expect.
However I haven't managed to get the GeoIP with the Endpoint statistics in a nice condensed way.
Info:
$ tshark -v
TShark (Wireshark) 3.6.2 (Git v3.6.2 packaged as 3.6.2-2)
Copyright 1998-2022 Gerald Combs <[email protected]> and contributors.
License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/gpl-2.0.html>
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) using GCC 11.2.0, with libpcap, with POSIX capabilities
(Linux), with libnl 3, with GLib 2.71.2, with zlib 1.2.11, with Lua 5.2.4, with
GnuTLS 3.7.3 and PKCS #11 support, with Gcrypt 1.9.4, with MIT Kerberos, with
MaxMind DB resolver, with nghttp2 1.43.0, with brotli, with LZ4, with Zstandard,
with Snappy, with libxml2 2.9.12, with libsmi 0.4.8.
Running on Linux 5.15.0-105-generic, with 12th Gen Intel(R) Core(TM) i7-12700H
(with SSE4.2), with 11655 MB of physical memory, with GLib 2.72.4, with zlib
1.2.11, with libpcap 1.10.1 (with TPACKET_V3), with c-ares 1.18.1, with GnuTLS
3.7.3, with Gcrypt 1.9.4, with nghttp2 1.43.0, with brotli 1.0.9, with LZ4
1.9.3, with Zstandard 1.4.8, with libsmi 0.4.8, with LC_TYPE=en_US.UTF-8, binary
plugins supported (0 loaded).