Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Here is the scenario.

I have an IP address port 2000 sending udp packets to one unknown IP. I would like to find the unknown IP so I can block it with iptables.

Is there a way to do it with a script? Right now I am doing it manually by using

tshark -i eth1 -f "net and src port 2000"

I'm not sure how to pipe this into a script and automatically find the destination ip.

share|improve this question
up vote 4 down vote accepted

Just use tshark to output only the field in question by adding -Tfields -e ip.dst_host to your command line:

tshark -i eth1 -Tfields -e ip.dst_host -f "net and src port 2000"

To get only the first occurrence, gather only a small number of packets and pass through head:

tshark -i eth1 -Tfields -e ip.dst_host -f "net and src port 2000" -c 1000 | head -1

If you don't think 1000 packets are enough to turn up one packet to this port, increase that number.

share|improve this answer
Thanks this makes it easier. But how do I extract this into a script? I just want the first ip that shows up. – Bob Apr 10 '12 at 20:45
Edited to answer your question, Bob :) – Jon Lasser Apr 10 '12 at 20:53
Thanks that is exactly what I need. – Bob Apr 10 '12 at 20:55

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.