This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi, I am not very familiar with Wireshark so I apologize if this is too basic of a question. I have searched the forums for hints on how to accomplish what I am about to ask but was unsuccessful in finding any clues.

I want to verify the IP's seen by Wireshark. Basically I want to turn wireshark on for a while and have it gather a listing of all the IP's seen. No need for payload data at all. Currently I don't dare leave wireshark on for too long due to the amount of data it will consume. Is there a way to configure Wireshark to capture only this information so that I could leave it on for a while longer? As I said I just want to verify that the ip information corresponds to what we expect to see on a particular monitoring port.

This seems like a very basic utilization of Wireshark and maybe someone could suggest a tool better suited to this task on a windows 7 or XP machine.

Thanks for any hints on how to accomplish this.

Sammi

asked 19 Dec '11, 15:30

SamHnery's gravatar image

SamHnery
1111
accept rate: 0%


If you don't care about anything but the IP addresses, then to help cut down on the amount of data Wireshark captures, you can try setting the snaplen to only capture what you need. For example, assuming you are capturing on an Ethernet interface and assuming no vlan tagging, tunneling, etc., you might try a snaplen of 34 to limit the bytes you capture to only the Ethernet and IP headers.

You may also want to try experimenting with the command-line tools such as dumpcap and/or tshark along with some other shell commands such as sort, uniq, etc to accomplish what you need.

permanent link

answered 19 Dec '11, 16:19

cmaynard's gravatar image

cmaynard ♦♦
9.3k1038142
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×349
×178
×48

question asked: 19 Dec '11, 15:30

question was seen: 2,789 times

last updated: 19 Dec '11, 16:19

p​o​w​e​r​e​d by O​S​Q​A