How to sort IP addresses by numerical order?

Question

I want to sort IP addresses so that in ascending order, I get 10.0.0.1, 10.0.0.2, 10.0.0.3, etc.

Currently wireshark sorts by default to lexicographical order, i.e 10.0.0.1, 10.0.0.11, 10.0.0.12, 10.0.0.2, etc.

Is this possible in wireshark currently? Google and poking around in preferences yielded nothing.

Currently using wireshark 1.10.6.

Answer 1

You can script this with tshark and sort. For example:

tshark -r file.pcap -T fields -e ip.src | sort -u -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4

EDIT: Using "Statistics -> Endpoint List -> IPv4" or "Statistics -> Endpoints -> IPv4" works as expected, but the behavior is wrong when sorting by the Packet Details "Source" or "Destination" IP address columns. You may want to open a bug report for that incorrect sort behavior.