Wireshark-users: Re: [Wireshark-users] TCP Conversations Question

From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Fri, 04 Apr 2008 23:25:24 -0400

Tom.Saurer wrote:

Is there a way to have Wireshark only gather IP conversation stats (source IP/Port and destination IP/Port) as it watches a nic? We don’t need the full packet information. We need to gather this data for several weeks and it would be to hard to analyze a packet capture to pull that information.

There is no "Monitor" function built into Wireshark. It was actually discussed during Sharkfest (about adding support for this support).

But you can capture it with ring buffers/multiple files. It would be a pain, but then you can run tshark to gather the info you want.

Incidentally, Cacetech announced "Pilot" during Sharkfest. It's main purpose in life is to process pcap files that are large (hundreds of megabytes, for example).

--

Thanks,
Hansang