1 year ago

#199889

test-img

Am3Y

Extract IPs from Pcap Which are Matching the String

How can I extract IPs from a PCAP file whose packet has any of these hex strings.

--hex-string '|AF0DFT5F14|'
--hex-string '|AF0DFT5F25|'
--hex-string '|AF0DFT5F45|'

I just need the list of IPs.

I tried to search a lot on web but couldn't get any specific about this. I found out to extract all the IPs from a pcap file using the below command

( tcpdump -n -r m.pcap  | grep IP | cut -f 3 "-d " | cut -f1-4 -d.; tcpdump -n -r m.pcap  | grep IP | cut -f 5 "-d " | cut -f1-4 -d. ) | sort -u

Grep, awk, anything can do

linux

unix

awk

grep

tcpdump

0 Answers

Your Answer

Accepted video resources