This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How to find the total number of IP addresses observed in a trace?

I tried using "conversations" and "IP addresses", which are under statistics option, but didn't work.

asked 30 Jun '13, 08:44

Irock732's gravatar image

Irock732
11224
accept rate: 0%


Try this:

Windows

tshark -nr input.pcap -q -z ip_hosts,tree | find "Addresses"

Linux

tshark -nr input.pcap -q -z ip_hosts,tree | grep "Addresses"

Regards
Kurt

permanent link

answered 01 Jul '13, 21:59

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

can you explain this command? I've used wireshark here, to capture network packets and saved the trace. I want to find the total number of IP addresses observed in this trace.

(02 Jul '13, 01:00) Irock732

if you run that command at the CLI (tshark is part of Wireshark - a CLI tool), you will see something like this:

 IP Addresses            value          rate         percent
 IP Addresses             485       0.005124

My sample capture file contain 485 different IP addresses.

(02 Jul '13, 01:03) Kurt Knochner ♦

Try

Statistics>EndPoint List>IPV4

permanent link

answered 30 Jun '13, 09:16

krishnayeddula's gravatar image

krishnayeddula
629354148
accept rate: 6%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×178
×36

question asked: 30 Jun '13, 08:44

question was seen: 9,369 times

last updated: 02 Jul '13, 01:03

p​o​w​e​r​e​d by O​S​Q​A