Peter Marshall wrote:
> Hi,
>
> I am looking for a way to summarize a capture file so that it only
> displays one line from every unique socket.
>
> src-ip-a:src-port - dest-ip-a:dest-port-a
> src-ip-b:src-port - dest-ip-b:dest-port-b
> src-ip-c:src-port - dest-ip-c:dest-port-c
> .
> .
> .
>
> I do not necessarily care about the source port.
>
> Is this possible with wireshark or another 3rd party app?
You could select "Statistics->Conversation List->TCP (IPv4 & Ipv6)", click on
the "Copy" button, and import the results into Excel.
You could also use TShark:
tshark -z conv,tcp -q -r /path/to/capture/file | \
awk '/^[0-9]/ {print $1, "-", $3}'
tshark -n \
-R 'tcp.flags == 0x12 && tcp.analysis.acks_frame' \
-r /path/to/capture/file \
| awk {'printf "%s:%s - %s:%s\n", $6, $10, $4, $8}'
In the second example "tcp.flags == 0x12" matches any flag with SYN+ACK set.
"tcp.analysis.acks_frame" is a bit of paranoia to make sure we've captured a
matching SYN.
