This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

finding the total number of IP addresses

0

How to find the total number of IP addresses observed in a trace?

I tried using "conversations" and "IP addresses", which are under statistics option, but didn't work.

asked 30 Jun '13, 08:44

Irock732's gravatar image

Irock732
11224
accept rate: 0%


2 Answers:

1

Try this:

Windows

tshark -nr input.pcap -q -z ip_hosts,tree | find "Addresses"

Linux

tshark -nr input.pcap -q -z ip_hosts,tree | grep "Addresses"

Regards
Kurt

answered 01 Jul '13, 21:59

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

can you explain this command? I've used wireshark here, to capture network packets and saved the trace. I want to find the total number of IP addresses observed in this trace.

(02 Jul '13, 01:00) Irock732

if you run that command at the CLI (tshark is part of Wireshark - a CLI tool), you will see something like this:

 IP Addresses            value          rate         percent
 IP Addresses             485       0.005124

My sample capture file contain 485 different IP addresses.

(02 Jul '13, 01:03) Kurt Knochner ♦

0

Try

Statistics>EndPoint List>IPV4

answered 30 Jun '13, 09:16

krishnayeddula's gravatar image

krishnayeddula
629354148
accept rate: 6%