Addresses and ports, simply

Which machine, and which door

Every packet has two IP addresses: where it came from and where it is going. Think of the IP address as the street address of a building.

But a building has many doors. On a computer, those doors are called ports, and each common service sits behind a known door number: web pages on port 80 and 443, SSH on 22, email on 25. So “connect to 93.184.216.34 port 443” means “go to that building, knock on the secure-web door”.

tshark can show both ends at once. Here we print the source address, destination address and destination port of every packet:

tshark -r /home/student/case/capture.pcap -T fields -e ip.src -e ip.dst -e tcp.dstport 2>/dev/null

In the terminal

student@vulntech:~$ tshark -r /home/student/case/capture.pcap -T fields -e ip.src -e ip.dst -e tcp.dstport 2>/dev/null
10.10.10.5	93.184.216.34	80
93.184.216.34	10.10.10.5	49710
10.10.10.5	93.184.216.34	80
10.10.10.5	93.184.216.34	80

Tip: A destination port tells you what the sender was trying to reach. Port 80 means a web server, 22 means SSH, and so on. Memorising a handful of these pays off fast.