TShark & jq

Published: 2022-01-08
Last Updated: 2022-01-08 14:59:29 UTC
by Didier Stevens (Version: 1)
0 comment(s)

TShark (Wireshark's command-line version) can output JSON data, as shown in diary entry "Quicktip: TShark's Options -e and -T".

jq is a JSON processor, that I've shown before in diary entries like "Retrieving and processing JSON data (BTC example)".

In this diary entry, I will show how to use tshark and jq to produce a list of unique IPv4 addresses.

This tshark command reads a capture file and produces JSON output for the ip.src field:

This JSON data is an array of dictionaries. To read and start processing this JSON data, I pipe the output to jq and use a filter to iterate over the array: .[]

Next I pipe this iteration output into ._source to select values for key _source:

And I do the same for keys layers and ip.src:

For ip.src, remark that this key contains a dot (.), and a dot has special meaning in jq filters: it's an operator. Thus, I need to escape it, like this: \"ip.src\".

Now I have an iteration of arrays, each one containing an IPv4 address. I index this array to select the first IPv4 address:

Remark that there can be more than on ip.src address inside a single packet, I will discuss this in an upcoming diary entry.

Next, I put this iteration of IPv4 addresses (strings, actually) into an array:

And now that I have an array of IPv4 addresses, I can pipe it into function unique to produce an array where each IPv4 address is unique (e.g., appears only once):

Didier Stevens
Senior handler
Microsoft MVP
blog.DidierStevens.com

Keywords: wireshark tshark jq
0 comment(s)

Comments

cwqwqwq
eweew<a href="https://www.seocheckin.com/edu-sites-list/">mashood</a>
WQwqwqwq[url=https://www.seocheckin.com/edu-sites-list/]mashood[/url]
dwqqqwqwq mashood
[https://isc.sans.edu/diary.html](https://isc.sans.edu/diary.html)
[https://isc.sans.edu/diary.html | https://isc.sans.edu/diary.html]
What's this all about ..?
password reveal .
<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure:

<a hreaf="https://technolytical.com/">the social network</a> is described as follows because they respect your privacy and keep your data secure. The social networks are not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go.

<a hreaf="https://technolytical.com/">the social network</a> is not interested in collecting data about you. They don't care about what you're doing, or what you like. They don't want to know who you talk to, or where you go. The social networks only collect the minimum amount of information required for the service that they provide. Your personal information is kept private, and is never shared with other companies without your permission
https://thehomestore.com.pk/

Diary Archives