This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.
0
1

Im getting ddos'd by a large group of servers, large enough that sorting IP's human wise is too large but small enough that I'd like to block all of them. My one second capture has each one hitting ~50-100 times and its consistently from these IP's (It's not from the same IP range)

Any way i could dump these into text?

asked 24 Jul '12, 11:45

ryanb213's gravatar image

ryanb213
0121
accept rate: 0%


The following will create a list of Cisco ACL lines to block the IP's, if you need it in another syntax, I'm sure you will manage :-)

tshark -r file.cap -R "tcp.flags==2" -T fields -e ip.src |\
  sort |\
  uniq |\
  awk '{printf("deny ip host %s any\n",$1)}'

Hope this helps :-)

permanent link

answered 24 Jul '12, 13:58

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

edited 24 Jul '12, 16:18

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142

You could use the statistics/endpoint function. There is a copy button that allows you to copy the list to the clipboard, from which you can paste it to a text editor.

permanent link

answered 24 Jul '12, 11:57

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Thank you, im new to wireshark but that solved my exact problem. I was getting saturated on my gbps line but i only needed 6 filter rules to block it.

Thank you!

(24 Jul '12, 14:08) ryanb213

Please check if one of the following helps:

tshark -r input.cap.pcapng -q -z hosts
tshark -r input.cap.pcapng -q -z ip_hosts,tree

windows: tshark -r input.cap.pcapng -q -z conv,tcp | find "192.168.x.x"
unix: tshark -r input.cap.pcapng -q -z conv,tcp | grep "192.168.x.x"

Where 192.168.x.x is the IP address of your attacked server.

Regards
Kurt

permanent link

answered 24 Jul '12, 12:02

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 24 Jul '12, 12:12

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×178
×31
×22

question asked: 24 Jul '12, 11:45

question was seen: 17,833 times

last updated: 24 Jul '12, 16:18

p​o​w​e​r​e​d by O​S​Q​A