Counting packets and finding the talkers

Two quick questions for any capture

When you first open a capture, ask two things: how many packets are there? and which machines are talking? For the count, pipe tcpdump into wc -l (count lines):

tcpdump -nr /home/student/case/capture.pcap | wc -l

In the terminal

student@vulntech:~$ tcpdump -nr /home/student/case/capture.pcap | wc -l
reading from file /home/student/case/capture.pcap, link-type EN10MB (Ethernet), snapshot length 65535
6

For the addresses, tshark (the command-line version of Wireshark) can print just one field per packet. Here we ask for the source address of every packet and count how often each one appears:

tshark -r /home/student/case/capture.pcap -T fields -e ip.src 2>/dev/null | sort | uniq -c | sort -rn

In the terminal

student@vulntech:~$ tshark -r /home/student/case/capture.pcap -T fields -e ip.src 2>/dev/null | sort | uniq -c | sort -rn
      4 10.10.10.5
      2 93.184.216.34

Tip: tshark -T fields -e NAME prints just the field you name. ip.src is the sender, ip.dst the receiver, tcp.dstport the destination port.