TShark pcap filter command possibly simplified?
1
vote
1
answer
395
views
Object: to find the IP addresses of HTTP servers in a pcap file with a specific header string. Can or should the
-l
option to flush be used?
One way: the following was done but am wondering if it can be shortened. If this question is too broad, please advise.
tshark -r file.pcap -T fields -e ip.src -e http.server > name.txt && cat name.txt | sort | uniq -c | sort -nr | grep "xxx_xxx"
Asked by stonetwigger
(113 rep)
Oct 9, 2021, 01:03 AM
Last activity: Oct 9, 2021, 05:58 AM
Last activity: Oct 9, 2021, 05:58 AM