We are interested in developing a baseline for our network traffic between sites. This will be used to create port-based ACLs on the routers.
In order to reduce the size of our captures, we are planning to use a capture filter to look for SYN packets. However, ideally the end-game is to have a list of ports for each site and therefore we only need ONE SYN packet for each IP address/port pair. I can massage the data after the capture, but I'm wondering if anyone has any advice of clever and easy ways to do this in Wireshark.
Thanks, - Steve
asked 30 Sep '10, 12:12
This is something that Wireshark can't do, but fortunately, tshark can. Tshark is part of the CLI tools that are installed too when you install Wireshark.
You can use the following:
If you also would like to know from which IP's the traffic is coming from, you can use:
And if you are interested in how often sessions are set up, just add "-c" at the end. If you would like to have a top 10 of destination host/ports, you can use:
(if you use windows, these commands can be used within a cygwin shell, have a look at http://www.cygwin.com)
answered 30 Sep '10, 12:54