You'll get list, in ascending order of frequency, of each unique src, dst and proto combination present within your sample file. But it is displaying only ARP, 0x0800, 0x8912, etc. For example, if you append this to that command line: |sort -n |uniq -c |sort -n As you can see, Wireshark is definitely capturing a lot of TCP packets.
It will capture all the port traffic and show you all the port numbers in the specific connections. Under Linux (which is what I use), you can easily pipe the output of that into various other utility programs. Wireshark captures all the network traffic as it happens. If you'd prefer to eliminate the non-IPv4 packets, just add a filter: tshark -r -2 -Tfields -R ip -eip.src -eip.dst -eframe.protocols With that command line, you'll get exactly those fields, but be aware that some lines, such as those with ARP packets, won't have IP addresses (because they're not IP packets), and that IPv6 packets won't show IP addresses because those field names ( ip.src and ip.dst) are only for IPv4. So with that approach in mind, you could use this: tshark -r -2 -Tfields -eip.src -eip.dst -eframe.protocols You can also see advanced features by clicking capture, then selecting options. When I've done that sort of thing before, I typically use tshark to extract the data and then other tools (Python, Perl, awk, etc.) to further refine the resulting data. Upon launching the application, you’ll see the available network connections in the launch screen.
0 kommentar(er)
