This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

IP Addresses and Hostnames in one tshark output

0

I've been trying to get both IP address and hostname with tshark. From Wireshark it is easy, but from tshark I couldn't figure out how to do it. "-z ip_hosts,tree" parameter just give the IP Addresses even when I specify "-N n" parameter. How can I get this IP addresses and hostnames together?

By the way -z hosts does not give all IPs and hostnames, sometimes does not give anything at all.

asked 30 Jul '15, 07:08

xmikro's gravatar image

xmikro
11●2●2●5
accept rate: 0%

One Answer:

0

Try the -T and -e options. For example:

-T fields -e ip.addr

answered 30 Jul '15, 09:25

Amato_C's gravatar image

Amato_C
1.1k●14●20●32
accept rate: 14%

Thanks! tshark -T fields -e ip.dst_host -e ip.dst is just what I wanted. But do you have any idea why -z hosts parameter does not work?

(31 Jul '15, 00:39) xmikro