'\" -*- coding: UTF-8 -*-
.if \n(.g .ds T< \\FC
.if \n(.g .ds T> \\F[\n[.fam]]
.de URL
\\$2 \(la\\$1\(ra\\$3
..
.if \n(.g .mso www.tmac
.TH pcapuc 1 "29 March 2024" "" ""
.SH NAME
pcapuc \- filter a pcap for IP addresses
.SH SYNOPSIS
'nh
.fi
.ad l
\*(T<\fBpcapuc\fR\*(T> \kx
.if (\nx>(\n(.l/2)) .nr x (\n(.l/5)
'in \n(.iu+\nxu
[\fIOPTIONS\fR]\&...
'in \n(.iu-\nxu
.ad b
'hy
.SH DESCRIPTION
\fBpcapuc\fR parses an input pcap file and prints unique IP addresses and the number of packets each IP address appeared in. Optionally, \fBpcapuc\fR can limit its output to addresses that only appear in the source address field of the IP header, addresses that only appear in the destination address field, or sets of IP addresses that appear in the source and destination address fields.
.SH "PCAPNET OPTIONS"
.TP 
\*(T<\fB\-i \fR\*(T>\fIinterface\fR
Input interface to read packets from.
.TP 
\*(T<\fB\-r \fR\*(T>\fIpcap file\fR
Dump file to read packets from.
.TP 
\*(T<\fB\-w \fR\*(T>\fIpcap file\fR
Dump file to write filtered packets to.
.TP 
\*(T<\fB\-f \fR\*(T>\fIexpression\fR
BPF expression which selects packets to be filtered.
.TP 
\*(T<\fB\-s \fR\*(T>\fIsnaplen\fR
Capture \fIsnaplen\fR bytes of data from each packet.
.TP 
\*(T<\fB\-p\fR\*(T>
Disable promiscuous mode sniffing.
.SH "PROGRAM OPTIONS"
.TP 
\*(T<\fB\-S\fR\*(T>
count source IP addresses only
.TP 
\*(T<\fB\-D\fR\*(T>
count destination IP addresses only
.TP 
\*(T<\fB\-P\fR\*(T>
count pairs of IP addresses
.TP 
\*(T<\fB\-C\fR\*(T>
output only the number of unique IP addresses or IP address pairs