Ubuntu: How to get all the mac address from captured package? [closed]



Question:

tcpdump -i any -w all.cap
Now how to get get all the mac address from captured package?
Same mac address as one address.


Solution:1

First install tshark

sudo apt-get install tshark  

Now we have tool to read conntent of .cap file

With command

tshark -r all.cap -i eth0 -nn -e eth.src -Tfields  

you will get output somethng like this

00:17:31:91:0c:8c  00:17:31:91:0c:8c  00:17:31:91:0c:8c  00:e0:1e:b4:12:42  00:17:31:91:0c:8c  00:17:31:91:0c:8c  54:a0:50:64:cc:39  00:e0:1e:b4:12:42  54:a0:50:64:cc:39  00:e0:1e:b4:12:42  54:a0:50:64:cc:39  00:e0:1e:b4:12:42  54:a0:50:64:cc:39  00:17:31:91:0c:8c  00:17:31:91:0c:8c  54:a0:50:64:cc:39  

or you can modify commanad

tshark -r aalmac.pcap -i eth0 -nn -e ip.src -e eth.src -Tfield  

and get output

xxx.xxx.xxx.205 00:17:31:91:0c:8c  xxx.xxx.xxx.205 00:17:31:91:0c:8c  xxx.xxx.xxx.205 00:17:31:91:0c:8c      00:e0:1e:b4:12:42  xxx.xxx.xxx.205 00:17:31:91:0c:8c  xxx.xxx.xxx.205 00:17:31:91:0c:8c  xxx.xxx.xxx.5   54:a0:50:64:cc:39  xxx.xxx.xxx.40  00:e0:1e:b4:12:42  xxx.xxx.xxx.5   54:a0:50:64:cc:39  xxx.xxx.xxx.247 00:e0:1e:b4:12:42  xxx.xxx.xxx.5   54:a0:50:64:cc:39  xxx.xxx.xxx.189 00:e0:1e:b4:12:42  xxx.xxx.xxx.5   54:a0:50:64:cc:39  xxx.xxx.xxx.205 00:17:31:91:0c:8c  xxx.xxx.xxx.205 00:17:31:91:0c:8c  xxx.xxx.xxx.5   54:a0:50:64:cc:39  xxx.xxx.xxx.143 00:e0:1e:b4:12:42  xxx.xxx.xxx.5   54:a0:50:64:cc:39  xxx.xxx.xxx.143 00:e0:1e:b4:12:42  xxx.xxx.xxx.5   54:a0:50:64:cc:39  xxx.xxx.xxx.155 00:e0:1e:b4:12:42  xxx.xxx.xxx.5   54:a0:50:64:cc:39      00:e0:1e:b4:12:42  xxx.xxx.xxx.154 00:e0:1e:b4:12:42  xxx.xxx.xxx.205 00:17:31:91:0c:8c  xxx.xxx.xxx.5   54:a0:50:64:cc:39  

You can see that on some ip I have two or more mac address. That mean that ip comes to me from the same port on router.

Next you can modify command to look like this

 tshark -r all.cap -i eth0 -nn -e eth.src -Tfields | sort | uniq  

and You will get sorted and unique mac <-> ip pair

xxx.xxx.xxx.154 00:e0:1e:b4:12:42  xxx.xxx.xxx.69  00:e0:1e:b4:12:42  xxx.xxx.xxx.69  00:e0:1e:b4:12:42  xxx.xxx.xxx.143 00:e0:1e:b4:12:42  xxx.xxx.xxx.155 00:e0:1e:b4:12:42  xxx.xxx.xxx.23  00:e0:1e:b4:12:42  xxx.xxx.xxx.13  00:e0:1e:b4:12:42  xxx.xxx.xxx.247 00:e0:1e:b4:12:42  xxx.xxx.xxx.77  00:e0:1e:b4:12:42  xxx.xxx.xxx.138 00:e0:1e:b4:12:42  xxx.xxx.xxx.18  00:1e:8c:a8:3a:9b  xxx.xxx.xxx.205 00:17:31:91:0c:8c  

...


Note:If u also have question or solution just comment us below or mail us on toontricks1994@gmail.com
Previous
Next Post »