This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

remove duplicate results

0

Hello,

I am trying to produce report of nmap scan to my uni with all open ports on target host. I just need to remove duplicates from my outcome. Can you please help?

ip.addr==172.16.121.145 && ip.addr==172.16.121.143 && ip.proto == 6 and tcp.flags == 18

Best regards Marcin

asked 02 May '14, 10:52

brayan6611's gravatar image

brayan6611
11●1●1●2
accept rate: 0%

Some questions.

  • what's wrong with the nmap report itself, meaning why do you want to complicate things while you already have a good solution ? ;-))
  • can you please define what duplicates are in that context?

I need to present this in Wireshark as a proof,

As a proof for what exactly?

is there a filter parameter to show only unique results

unique in term of what? Unique IP address, unique destination port?

(02 May '14, 11:46) Kurt Knochner ♦

One Answer:

0

I guess you're not talking about duplicate packets, but somehow duplicate results in your report list.

Easiest way around things like that is to export the packet list to CSV (see File menu, choose "Export Packet Dissections" -> "as CSV file" and save the results to a file. Then deduplicate the text lines in that file.

answered 02 May '14, 11:29

Jasper's gravatar image

Jasper ♦♦
23.8k●5●51●284
accept rate: 18%

Thank you Jasper for quick response. I need to present this in Wireshark as a proof, there fore I don't want to edit. I don't know Wireshark well but is there a filter parameter to show only unique results?

Best regards Marcin

(02 May '14, 11:33) brayan6611

That depends on your current results. Is there anything in a duplicate that is different than the original? If so, you can use that difference to filter the duplicates out. It's kinda hard to give more advice without seeing what you're working with; the filter does not help because it is unclear what it was used on.

(02 May '14, 11:35) Jasper ♦♦