Wireshark · Wireshark-users: Re: [Wireshark-users] TCP Conversations Question

[Hansang Bae <hbae@xxxxxxxxxx>]

Tom.Saurer wrote:
> Is there a way to have Wireshark only gather IP conversation stats 
> (source IP/Port and destination IP/Port) as it watches a nic? We don’t 
> need the full packet information. We need to gather this data for 
> several weeks and it would be to hard to analyze a packet capture to 
> pull that information.

There is no "Monitor" function built into Wireshark.  It was actually 
discussed during Sharkfest (about adding support for this support).

But you can capture it with ring buffers/multiple files.  It would be a 
pain, but then you can run tshark to gather the info you want.

Incidentally, Cacetech announced "Pilot" during Sharkfest.  It's main 
purpose in life is to process pcap files that are large (hundreds of 
megabytes, for example).


--

Thanks,
Hansang