Packet and flow triage

Fast first-pass pivots for packet captures.

Most common IP pairs

tshark -r capture.pcap -T fields -e ip.src -e ip.dst | sort | uniq -c | sort -nr | head

DNS queries

tshark -r capture.pcap -Y 'dns.flags.response == 0' -T fields -e frame.time -e ip.src -e dns.qry.name

TLS server names

tshark -r capture.pcap -Y tls.handshake.extensions_server_name -T fields -e ip.src -e ip.dst -e tls.handshake.extensions_server_name

HTTP hosts and request URIs

tshark -r capture.pcap -Y http.request -T fields -e ip.src -e http.host -e http.request.uri