Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a large tcpdump file which I need to parse to identify the number of flows in the capture based on the ( source ip + source port , destination ip + destination port ) pairs. Does tcpdump / any other tool provide any means to obtain such data directly? / Any tips on how to optimize my parser to perform this operation? Any help / leads are very much appreciated. Thanks.

share|improve this question

Try something like this:

tcpdump -r capturefile.dmp | awk '{ print $3 " " $5 "\n" }' | sort | uniq | wc -l

Assuming your tcpdump generates the same output as mine, the awk command will print the source IP+port and the destination IP+port (followed by a colon, which is irrelevant in this case), like so:


Since an established connection will use the same portnumbers again you collapse these repeated lines with sort | uniq; wc -l counts the lines. You will have to divide this number by 2 since IP is bidirectional and it reverses source/destination when sending packets back.

You may want to filter out unwanted packets for UDP and ICMP and whatnot with tcpdump filters, and other stuff with a grep before sort.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.