Dump list of unique IP’s

Question

Im getting ddos'd by a large group of servers, large enough that sorting IP's human wise is too large but small enough that I'd like to block all of them. My one second capture has each one hitting ~50-100 times and its consistently from these IP's (It's not from the same IP range)

Any way i could dump these into text?

Answer 1

The following will create a list of Cisco ACL lines to block the IP's, if you need it in another syntax, I'm sure you will manage :-)

tshark -r file.cap -R "tcp.flags==2" -T fields -e ip.src |\
  sort |\
  uniq |\
  awk '{printf("deny ip host %s any\n",$1)}'

Hope this helps :-)

Answer 2

You could use the statistics/endpoint function. There is a copy button that allows you to copy the list to the clipboard, from which you can paste it to a text editor.

Answer 3

Please check if one of the following helps:

tshark -r input.cap.pcapng -q -z hosts
tshark -r input.cap.pcapng -q -z ip_hosts,tree

windows: tshark -r input.cap.pcapng -q -z conv,tcp | find "192.168.x.x"
unix: tshark -r input.cap.pcapng -q -z conv,tcp | grep "192.168.x.x"

Where 192.168.x.x is the IP address of your attacked server.

Regards
Kurt