mirror of
https://github.com/wader/fq.git
synced 2024-10-04 07:27:08 +03:00
10 lines
388 B
Markdown
10 lines
388 B
Markdown
|
### Build object with number of (reassembled) TCP bytes sent to/from client IP
|
||
|
|
```sh
|
||
|
|
# for a pcapng file you would use .[0].tcp_connections for first section
|
||
|
|
$ fq '.tcp_connections | group_by(.client.ip) | map({key: .[0].client.ip, value: map(.client.stream, .server.stream | tobytes.size) | add}) | from_entries'
|
||
|
|
{
|
||
|
|
"10.1.0.22": 15116,
|
||
|
|
"10.99.12.136": 234,
|
||
|
|
"10.99.12.150": 218
|
||
|
|
}
|
||
|
|
```
|