Free Online PCAP IP Extractor
Extract every internal and external IP address from your Wireshark PCAP capture. Classify RFC 1918 subnets, see observed ports, and export clean IOC lists instantly.
Volatile Client Memory
No packet captures or IP logs are ever sent over the network. Processing runs in an isolated browser sandbox.
Subnet Classification
Instantly separates private RFC 1918 subnets from routable public endpoints to isolate potential external Command & Control.
SIEM & Firewall IOCs
Export IP lists ready to feed into Splunk, Microsoft Sentinel, iptables, or firewall blocklists in seconds.
Extract IPs: NetNerve vs. TShark & Tcpdump
If you typically parse captures in the Linux terminal, here is how NetNerve's client-side browser extractor compares to standard CLI pipelines:
tshark -r capture.pcap -T fields \
-e ip.src -e ip.dst \
| tr '\t' '\n' \
| sort -u > ips.txtExtracts unique IPs, but does not classify RFC 1918 internal subnets or associate observed transport ports without complex awk scripting.
tcpdump -nn -r capture.pcap \
| awk '{print $3 "\n" $5}' \
| cut -d. -f1-4 \
| sort -uFast for live interfaces, but requires striping port suffixes and cannot process PCAPNG blocks reliably without conversion.
Frequently Asked Questions
How does NetNerve extract IPs from PCAP files?
The tool reads Ethernet frames, decodes IPv4 and IPv6 headers (extracting source and destination addresses), and deduplicates all observed hosts while tracking packet frequency and active transport ports.
How are internal and external IPs distinguished?
The extractor evaluates each address against IANA RFC 1918 standards (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) as well as loopback (127.0.0.0/8) and APIPA ranges. Non-matching addresses are classified as Public WAN endpoints.
How can I extract IPs from PCAP using tshark or bash?
With tshark installed, run: tshark -r capture.pcap -T fields -e ip.src -e ip.dst | tr '\t' '\n' | sort -u. NetNerve performs this exact operation directly in your web browser without requiring any software installation.
Can I export the extracted IP addresses into SIEM blocklists?
Yes. Use the "Copy IPs" or "Download TXT" buttons to obtain a clean, line-delimited list of unique IP addresses ready for ingestion into firewall blocklists, Splunk lookups, Microsoft Sentinel watchlists, or threat intelligence feeds.
Related Network Analysis Tools & Reports
View all threat teardownsConvert full frame streams into Excel & Pandas CSVs.
Anonymize MACs, IPs, and payloads before sharing.
Maldoc macro, zev2 check-in & C2 beaconing.
Cloud AI vs. desktop packet sniffing.