awk - Extract time and source ip address from pcap file -


I have a PAPT trace file and I want to remove time and source IP addresses from packets. I am using tcpdump and awk here is a sample of the file

  02: 00: 00.001814 IP 61.31.228.1.80 & gt; 0.106.173.16.19999: Flag [S], Seac 4049606604, ACC 4044405336, 512 wins, length 0 02: 00: 00.005787 IP 61.31.228.1.80 & gt; 0.4.173.19.13923: Flag [S], Seek 3812128115, AK 3811406374, 512 wins, length 0 02: 00: 00.005799 IP 74.54.182.242.80 & gt; 0.176.229.61.43527: Flags [S], SAC 61247722, AK 352633207, WIN 65535, OPTION [MSC 1460, NOP, NOP, SAPOK], length 0   

Then I applied the CSV To remove time and source IP address in the file, awk:

  02: 00: 00.001814,0.106.173.16.199 99: 02: 00: 00.005787,0.4.173.19.13923: 02: 00: 00.005799,0.176.229.61.43527:   

I am only interested in the last bit of time and I am getting rid of "" at the end of the source IP ".

Div class = "post-text" itemprop = "text">

Try this:

  awk -F '[:.] "$ 5 ==" IP "{print $ 4 "$ 12", "$ 13". "$ 14". "$ 15} '  

Output
  001814,0.106.173.16 005787 , 0.4.173.19 005799,0.176.229.61    

Comments

Popular posts from this blog

excel vba - How to delete Solver(SOLVER.XLAM) code -

github - Teamcity & Git - PR merge builds - anyway to get HEAD commit hash? -

ios - Replace text in UITextView run slowly -