title: Extracting information from PCAP
body: <p>the logs are formatted below. there is also brackets around each **.</p>
  
  <pre><code>03/16-08:30:05.350000 ** [1:491:8] INFO FTP Bad login ** [Classification: Potentially Bad Traffic] [Priority: 2] {TCP} 192.168.21.101:21 -&gt; 192.168.202.102:4061
  </code></pre>
  
  <p>what I am trying to do is:</p>
  
  <ul>
  <li>extract all destination IPs</li>
  <li>extract source IP/destination IP/port pairs</li>
  <li>view all events associated with source IP and get a count of all destinations from the identified source IP</li>
  </ul>
  
  <p>I have just exctracted all IPs and ports:</p>
  
  <pre><code>grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\:[0-9]\{3,10\}' alert.pcap | sort | uniq
  </code></pre>