1

I'm using WireShark to find any systems pointed to an old system we're decommissioning and rather than showing the same IP 1,000 times I'd like to use a filter that will only show each IP source once.

Can somebody tell me how I can go about doing this?

Thanks in advance for your help.

2 Answers 2

2

Take a look at the statistics menu:
- Conversations
- Endpoints
- IP Addresses…

You can find more information in Wireshark Wiki.

1

This is a breeze from the command line if you have linux or cygwin (IP 1.2.3.4 is the old system):

tshark -nr file.pcap -Tfields -e ip.src -Y "tcp.flags==2 and ip.dst==1.2.3.4" | sort | uniq

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .