Wireshark-users: Re: [Wireshark-users] summery of unique socket connections

From: Gerald Combs <gerald@xxxxxxxxxxxxx>
Date: Wed, 01 Oct 2008 11:42:19 -0700

Peter Marshall wrote:
> Hi,
> 
> I am looking for a way to summarize a capture file so that it only 
> displays one line from every unique socket.
> 
> src-ip-a:src-port - dest-ip-a:dest-port-a
> src-ip-b:src-port - dest-ip-b:dest-port-b
> src-ip-c:src-port - dest-ip-c:dest-port-c
> .
> .
> .
> 
> I do not necessarily care about the source port.
> 
> Is this possible with wireshark or another 3rd party app?

You could select "Statistics->Conversation List->TCP (IPv4 & Ipv6)", click on
the "Copy" button, and import the results into Excel.

You could also use TShark:

tshark -z conv,tcp -q -r /path/to/capture/file | \
  awk '/^[0-9]/ {print $1, "-", $3}'

tshark -n \
  -R 'tcp.flags == 0x12 && tcp.analysis.acks_frame' \
  -r /path/to/capture/file \
 | awk {'printf "%s:%s - %s:%s\n", $6, $10, $4, $8}'

In the second example "tcp.flags == 0x12" matches any flag with SYN+ACK set.
"tcp.analysis.acks_frame" is a bit of paranoia to make sure we've captured a
matching SYN.