Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

how can tell tcpdump to not include the port numbers in the output? Right now it includes the resolved IP + resolved port. I just need the resolved IP address (hostnames)

share|improve this question
    
Did you read the man page? and did you try -qt? –  mossy Feb 1 '13 at 1:25
    
-qt gives me IP 68.142.93.173.80 > 10.0.0.2.51155: tcp 1448 which still has the port numbers on the end of the fields (the .80 and .51155) –  kormoc Feb 1 '13 at 1:27
    
@mossy -qt doesn't do what i am asking. –  Saqib Ali Feb 1 '13 at 2:06

1 Answer 1

up vote 1 down vote accepted

Do you just want a list of ip addresses?

If so, this will extract the to ip addresses

sudo tcpdump -n | cut -d ' ' -f 5 | awk -F. '{ if (NF == 2) { print $1 } else { print $1 FS $2 FS $3 FS $4 }}'

this will extract the from ip addresses

sudo tcpdump -n  | cut -d ' ' -f 3 | awk -F. '{ if (NF == 2) { print $1 } else { print $1 FS $2 FS $3 FS $4 }}'

ipv6 safe.

If you really just want everything other then the ports, this will do the trick (requires gawk)

sudo tcpdump | gawk '{
split($3, from, ".");
$3 = from[1]
for (i=2; i<length(from); i++) {
    $3 = $3 "." from[i] 
}

split($5, to, ".");
$5 = to[1]
for (i=2; i<length(to); i++) {
    $5 = $5 "." to[i] 
}

print
}'
share|improve this answer
    
this doesn't produce any result...... –  Saqib Ali Feb 1 '13 at 2:18
    
What os/version of tcpdump? Are you sure you're sending enough packets to get awk to flush it's buffers? –  kormoc Feb 1 '13 at 4:41
    
tcpdump -h tcpdump version 4.2.1 libpcap version 1.1.1 on Ubuntu 12.04 LTS –  Saqib Ali Feb 1 '13 at 12:15
    
i get:awk: line 4: illegal reference to array from awk: line 10: illegal reference to array to –  Saqib Ali Feb 1 '13 at 16:11
    
Sorry, this required GNU's awk (gawk). If you install that package and use gawk instead of awk in the command line, it works as expected –  kormoc Feb 1 '13 at 16:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.