title: tcpdump: Output only source and destination addresses
body: <p><strong>Problem description:</strong></p>
  
  <p>I want to print only the source and destination address from a tcpdump[1].</p>
  
  <p>Have one working solution, but believe it could be improved a lot. An example that captures 5 packets, just as an example of what I'm looking for:</p>
  
  <pre><code>tcpdump -i eth1 -n -c 5 ip | \
  cut -d" " -f3,5 | \
  sed -e 's/^\([0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\)\..* \([0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\).*$/\1 &gt; \2/'
  </code></pre>
  
  <p><strong>Question:</strong></p>
  
  <p>Can this be done in any easier way? Performance is also an issue here.</p>
  
  <p>[1] A part of a test if the snort home_net is correctly defined, or if we see traffic not defined in the home_net.</p>
  
  <hr>
  
  <p><strong>Solution:</strong></p>
  
  <p>Ok, thanks to everyone who have replied to this one. There have been two concerns related to the answers, one is the compatibility across different linux-versions and the second one is speed.</p>
  
  <p>Here is the results on the speed test I did.  First the grep-version:</p>
  
  <pre><code>time tcpdump -l -r test.dmp -n ip 2&gt;/dev/null | grep -P -o '([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+).*? &gt; ([0-9]+\.[0-9]+\.[0-9]+\.[0-9]+)' | grep -P -o '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+' | xargs -n 2 echo &gt;/dev/null
  
  real    0m5.625s
  user    0m0.513s
  sys     0m4.305s
  </code></pre>
  
  <p>Then the sed-version:</p>
  
  <pre><code>time tcpdump -n -r test.dmp ip | sed -une 's/^.* \(\([0-9]\{1,3\}\.\?\)\{4\}\)\..* \(\([0-9]\{1,3\}\.\?\)\{4\}\)\..*$/\1 &gt; \3/p' &gt;/dev/null
  reading from file test.dmp, link-type EN10MB (Ethernet)
  
  real    0m0.491s
  user    0m0.496s
  sys     0m0.020s
  </code></pre>
  
  <p>And the fastest one, the awk-version:</p>
  
  <pre><code>time tcpdump -l -r test.dmp -n ip | awk '{ print gensub(/(.*)\..*/,"\\1","g",$3), $4, gensub(/(.*)\..*/,"\\1","g",$5) }' &gt;/dev/null
  reading from file test.dmp, link-type EN10MB (Ethernet)
  
  real    0m0.093s
  user    0m0.111s
  sys     0m0.013s
  </code></pre>
  
  <p>Unfortunately I have not been able to test how compatible they are, but the awk needs gnu awk to work due to the gensub function. Anyway, all three solutions works on the two platforms I have tested them on. :)</p>