Wireshark Display Filter for Unique Source/Destination IP and Protocol

Question

I need to create a display filter that does the following: For each source IP address, list all destination IP addresses, but only list unique protocols for each destination IP address.

In other words, I want to see only one row of data for each unique: ip.src = X, ip.dst = Y, protocol = Z

I'd like to create this filter such that it covers all source IPs, so I don't have to create a separate filter for each source IP address.

I need to do the above for many PCAP files in "batch" mode. If this cannot be done in the Wireshark GUI, then I would like a command-line (tshark) solution.

Accepted Answer

I think you'll have to use tshark for this. One potential solution might be:

`tshark -r file.pcap -Y ip -T fields -e ip.src -e ip.dst -e _ws.col.Protocol | sort | uniq`

Note: If you want protocol numbers instead of protocol names, substitute -e ip.proto for _ws.col.Protocol, or use both if you prefer that.