Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] Faster: tshark or tcpcump?

From: Chip <jeffschips@xxxxxxxxx>
Date: Sun, 30 Oct 2011 17:43:51 -0400
For grabbing only the endpoint ips for https and http traffic, which is faster when dealing with high-bandwidth traffic, tshark or tcpdump?

I need to grab only the end to end point ips along with timestamp, in files, preferably in multiple files after a certain size limit.

This will be traffic gleaned from a in line tap.

Thank you.