I have a large tcpdump file which I need to parse to identify the number of flows in the capture based on the ( source ip + source port , destination ip + destination port ) pairs. Does tcpdump / any other tool provide any means to obtain such data directly? / Any tips on how to optimize my parser to perform this operation? Any help / leads are very much appreciated. Thanks.
Try something like this:
Assuming your tcpdump generates the same output as mine, the awk command will print the source IP+port and the destination IP+port (followed by a colon, which is irrelevant in this case), like so:
Since an established connection will use the same portnumbers again you collapse these repeated lines with
You may want to filter out unwanted packets for UDP and ICMP and whatnot with tcpdump filters, and other stuff with a