mirror of
https://github.com/wader/fq.git
synced 2024-11-26 21:55:57 +03:00
21 lines
630 B
Plaintext
21 lines
630 B
Plaintext
$ fq -h pcap
|
|
pcap: PCAP packet capture decoder
|
|
|
|
Decode examples
|
|
===============
|
|
|
|
# Decode file as pcap
|
|
$ fq -d pcap . file
|
|
# Decode value as pcap
|
|
... | pcap
|
|
|
|
Build object with number of (reassembled) TCP bytes sent to/from client IP
|
|
==========================================================================
|
|
# for a pcapng file you would use .[0].tcp_connections for first section
|
|
$ fq '.tcp_connections | group_by(.client.ip) | map({key: .[0].client.ip, value: map(.client.stream, .server.stream | tobytes.size) | add}) | from_entries'
|
|
{
|
|
"10.1.0.22": 15116,
|
|
"10.99.12.136": 234,
|
|
"10.99.12.150": 218
|
|
}
|