finding the total number of IP addresses

Question

How to find the total number of IP addresses observed in a trace?

I tried using "conversations" and "IP addresses", which are under statistics option, but didn't work.

Answer 1

1

Try this:

Windows

tshark -nr input.pcap -q -z ip_hosts,tree | find "Addresses"

Linux

tshark -nr input.pcap -q -z ip_hosts,tree | grep "Addresses"

Regards
Kurt

answered 01 Jul '13, 21:59

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

can you explain this command? I've used wireshark here, to capture network packets and saved the trace. I want to find the total number of IP addresses observed in this trace.

(02 Jul '13, 01:00) Irock732

if you run that command at the CLI (tshark is part of Wireshark - a CLI tool), you will see something like this:

 IP Addresses            value          rate         percent
 IP Addresses             485       0.005124

My sample capture file contain 485 different IP addresses.

(02 Jul '13, 01:03) Kurt Knochner ♦

Answer 2

0	Try Statistics>EndPoint List>IPV4 answered 30 Jun '13, 09:16 krishnayeddula 629●35●41●48 accept rate: 6%