Is it possible to use a blacklist.txt file as an input list for a wireshark | tshark displayfilter?

You could write a Lua plugin script to do it, running inside tshark or Wireshark. You can pass the filename(s) of your blacklist to the Lua plugin using the command line, and have the Lua plugin open the blacklist file(s) and build a match table, and have the plugin create either a post-dissector or Listener tap, which will get invoked for every packet letting you check the source and dest IP addresses against the match table; and if it matches then have the plugin either (1) add a field called "blacklisted" which you can then use as your actual display filter for tshark/wireshark, or (2) have the plugin save the blacklisted packet to a new pcap file directly.

Based on the information provided so far, I conclude, that you want to write the packets to/from blacklisted IP addresses to a new pcap file.

If so, here is my simple Perl example. Save the code to a file and run it like this:

perl extract_blacklist_frames.pl blacklist.txt capturefile1.pcap

This will create a new pcap file called: capturefile1.pcap_blacklist.pcap (I did not invest any time to create a 'pretty' new name. I leave that up to you).

If you want to process several files, run it in a loop on Unix/BSD like systems with a bash

for name in *.pcap
do 
echo processing file: $name
perl extract_blacklist_frames.pl blacklist.txt $name
done 

Blacklist file: one IP per line!

1.2.3.4
10.10.10.10
2.3.4.5

Perl code:

use Net::Pcap qw(:functions);
use NetPacket::Ethernet qw(:types);
use NetPacket::IP qw(:protos);
use warnings;
use strict;
my %blacklist;
my $blacklist_file = $ARGV[0] || die ("ERROR: please specifiy the name of the blacklist file\n");
my $pcap_file = $ARGV[1] || die ("ERROR: please specifiy the pcap file name\n");
my $pcap_file_blacklist = $pcap_file . "_blacklist.pcap";
my $pcap_read;
my $pcap_write;
read_blacklist();
process_pcap_file();
sub read_blacklist {
open(BLACKLIST, $blacklist_file) || die ("FATAL: cannot open blacklist file: $blacklist_file\n");
while (<BLACKLIST>) {
    chomp;
    $blacklist{$_} = 1;
}
close (BLACKLIST);

}
sub process_pcap_file {
my $err;
my $maxpkts;

$pcap_read = Net::Pcap::open_offline($pcap_file, \$err) || die("FATAL: cannot read pcap file $pcap_file: $err\n");
$pcap_write = Net::Pcap::dump_open($pcap_read, $pcap_file_blacklist) || die("FATAL: cannot write pcap file $pcap_file_blacklist: $err\n");

Net::Pcap::loop($pcap_read, $maxpkts, \&process_packet, '');

Net::Pcap::close($pcap_read);
Net::Pcap::dump_close($pcap_write);

}
sub process_packet {
my ($user_data, $header, $packet) = @_;
my $ip = NetPacket::IP->decode(NetPacket::Ethernet::strip($packet));
my $src_ip = $ip->{src_ip};
my $dst_ip = $ip->{dest_ip};

if (exists $blacklist{$src_ip} or exists $blacklist{$dst_ip}) {
    print "Blacklist IP found, writing packet\n";
    Net::Pcap::dump($pcap_write, $header, $packet);
}

}

HINT: The Perl script will be able to read pcap-ng files only if the libpcap version on your system is able to read pcap-ng, otherwise the script will throw an error! If that happens, either install the latest libpcap or convert the capture files to pcap style with editcap.

Regards
Kurt

Here's a quick Python script for you. It outputs any IP addresses in the .pcap which match those in the blacklist file.

Requires Python 3. Save this as a python file (.py) and run it (./filename.py).

Change these in the code to the files you're analysing: [.pcap file = packets.pcap] [blacklist file = blklstfile]

#!/usr/bin/python
import os
os.system("tshark -r packet.pcap -T fields -e ip.src | sort | uniq > temp")
blklst = [line.rstrip("\n") for line in open("blklstfile")]
temp = open("temp", "r")
for blkip in temp.readlines():
 blkip = blkip.rstrip("\n")
 if blkip == "#":
  continue
 check = blkip
 if check!="" and check in blklst:
  print("Blacklisted IP found:" + check)

Not quite what you're asking for but it will flag any blacklisted IP addresses if they appear in the PCAP file.