Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Here is the scenario.

I have an IP address 1.2.3.4 port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables.

Is there a way to do it with a script? Right now I am doing it manually by using

tshark -i eth1 -f "net 1.2.3.4 and src port 2000"

I'm not sure how to pipe this into a script and automatically find the destination ip.

share|improve this question

1 Answer 1

up vote 4 down vote accepted

Just use tshark to output only the field in question by adding -Tfields -e ip.dst_host to your command line:

tshark -i eth1 -Tfields -e ip.dst_host -f "net 1.2.3.4 and src port 2000"

To get only the first occurrence, gather only a small number of packets and pass through head:

tshark -i eth1 -Tfields -e ip.dst_host -f "net 1.2.3.4 and src port 2000" -c 1000 | head -1

If you don't think 1000 packets are enough to turn up one packet to this port, increase that number.

share|improve this answer
    
Thanks this makes it easier. But how do I extract this into a script? I just want the first ip that shows up. –  Bob Apr 10 '12 at 20:45
    
Edited to answer your question, Bob :) –  Jon Lasser Apr 10 '12 at 20:53
    
Thanks that is exactly what I need. –  Bob Apr 10 '12 at 20:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.