pcapuc1

Usage

Overview

pcapuc parses an input pcap file and prints unique IP addresses and the number of packets each IP address appeared in. Optionally, pcapuc can limit its output to addresses that only appear in the source address field of the IP header, addresses that only appear in the destination address field, or sets of IP addresses that appear in the source and destination address fields.

Options

FC-i F[0]interface

Input interface to read packets from.

FC-r F[0]pcap file

Dump file to read packets from.

FC-w F[0]pcap file

Dump file to write filtered packets to.

FC-f F[0]expression

BPF expression which selects packets to be filtered.

FC-s F[0]snaplen

Capture snaplen bytes of data from each packet.

FC-pF[0]

Disable promiscuous mode sniffing.

Options

FC-SF[0]

count source IP addresses only

FC-DF[0]

count destination IP addresses only

FC-PF[0]

count pairs of IP addresses

FC-CF[0]

output only the number of unique IP addresses or IP address pairs