Whireshark alle IP-Adressen aus cap Datei auslesen mit vorgefertigtem Filter (Windows 11 neu installation)

Windows ruft etliche IP-Adressen bei einer Neuinstallation auf. 

CAP erzeugen per Fritzbox:
- Um den Datestrom zu verringern am einfachsten den PC mit der Neuinstallation an das Gastnetz anschließen
- http://fritz.box/html/capture.html mit einem 2. PC aufrufen und den netzwerkschnittstellen Mitschnitt von guest per Start aufnehmen.
- nach einer Zeit den Mitschnitt stoppen

Alle Ziel-IP Addressen auslesen geht leider nicht in einem Schritt. Hierfür bietet sich Whireshark und Excel an.

  1. *.cap Datei in Whireshark laden.

  2. Vorfilter anwenden: (IP6 und Broadcast etc entfernen für eine bessere Übersicht)
    Rot ist der eigene IP-Bereich.
    Menü:  Datei -> Kopfdaten entfernen und folgendes im Dialogfenster einfügen
    !(ipv6 || ip.addr==224.0.0.0/4 || _ws.col.protocol=="HomePlug AV" || _ws.col.protocol=="LLDP" 
    || eth.dst==01:80:c2:00:00:0e || eth.dst==ff:ff:ff:ff:ff:ff || _ws.col.protocol=="ARP"
|| (ip.src==192.168.189.0/24 && ip.dst==192.168.189.0/24)) 
    Datei sichern als Wireshark *.pcapng

  3. Spaltenansicht auf Source  reduzieren
    # Rechtsklick auf Spaltenkopf und alle anderen ausklicken

  4. per STRG-A und STRG-C alle IP-Adressen kopieren

    Duplikate entfernen (in Excel)
    # Excel-Datei öffnen
    # per STRG-V die kopierten Ip-Adressen einfügen
    # IP-Adressen kopieren und im Menü: Daten -> Duplikate entfernen

  5.  via https://ipinfo.io/ können jetzt nach und nach die einzelnen Adressen ausgewertet werden.

IPs die aufgerufen werden nach einer Windows 11 prof. Neuinstallation

 

IPIP-RangeWerInfoIP EinzelnFormel
2.18.64.0/24 Akamai International B.V. 2.18.64.197;2.18.64.200 ip.addr==2.18.64.0/24||
184.30.128.0/21 Akamai International B.V.  184.30.131.245 ip.addr==184.30.128.0/21||
23.209.208.0/22 Akamai International B.V.  23209209225 ip.addr==23.209.208.0/22||
134.120.195.249 Akamai Technologies, Inc. ip.addr==134.120.195.249||
13.107.253.45 Akamai Technologies, Inc. ip.addr==13.107.253.45||
150.171.70.254 Akamai Technologies, Inc. ip.addr==150.171.70.254||
2.21.79.26 Akamai Technologies, Inc. ip.addr==2.21.79.26||
2.22.89.20 Akamai Technologies, Inc. ip.addr==2.22.89.20||
20.223.36.55 Akamai Technologies, Inc. ip.addr==20.223.36.55||
20.31.61.205 Akamai Technologies, Inc. ip.addr==20.31.61.205||
204.79.197.222 Akamai Technologies, Inc. ip.addr==204.79.197.222||
23.11.206.65 Akamai Technologies, Inc. ip.addr==23.11.206.65||
23.53.41.243 Akamai Technologies, Inc. ip.addr==23.53.41.243||
23.53.42.26 Akamai Technologies, Inc. ip.addr==23.53.42.26||
52.85.65.70 Akamai Technologies, Inc. ip.addr==52.85.65.70||
  95.100.102.0/23 Akamai Technologies, Inc. 95.100.102.49 ip.addr== 95.100.102.0/23||
173.222.108.0/23 Akamai Technologies, Inc. 1,73222E+11 ip.addr==173.222.108.0/23||
184.24.77.0/24 Akamai Technologies, Inc. ip.addr==184.24.77.0/24||
2.21.22.0/24 Akamai Technologies, Inc. 2.21.22.170 ip.addr==2.21.22.0/24||
2.21.78.0/23 Akamai Technologies, Inc. ip.addr==2.21.78.0/23||
2.22.89.0/24 Akamai Technologies, Inc. ip.addr==2.22.89.0/24||
23.2.13.0/24 Akamai Technologies, Inc. 23.2.13.26 ip.addr==23.2.13.0/24||
23.216.77.0/24 Akamai Technologies, Inc. 23.216.77.147 ip.addr==23.216.77.0/24||
23.32.100.0/22 Akamai Technologies, Inc. 23.32.101.182 ip.addr==23.32.100.0/22||
23.53.40.0/22 Akamai Technologies, Inc. 23.53.42.121; 23.53.42.179 ip.addr==23.53.40.0/22||
92.123.104.0/24 Akamai Technologies, Inc. 92.123.104.38 ip.addr==92.123.104.0/24||
96.16.122.0/24 Akamai Technologies, Inc. 96.16.122.69 ip.addr==96.16.122.0/24||
142.250.0.0/15 Amazon Data Services NoVa ip.addr==142.250.0.0/15||
18.173.152.0/21 Amazon Data Services NoVa ip.addr==18.173.152.0/21||
18.173.184.0/21 Amazon Data Services NoVa ip.addr==18.173.184.0/21||
18.66.192.0/24 Amazon Data Services NoVa ip.addr==18.66.192.0/24||
205.251.197.0/24 Amazon Data Services NoVa ip.addr==205.251.197.0/24||
205.251.198.0/24 Amazon Data Services NoVa ip.addr==205.251.198.0/24||
205.251.199.0/24 Amazon Data Services NoVa ip.addr==205.251.199.0/24||
104.18.32.0/24 Cloudflare, Inc. Hmm warum? 104.18.32.137 ip.addr==104.18.32.0/24||
104.18.80.0/20 Cloudflare, Inc. Hmm warum? ip.addr==104.18.80.0/20||
  194.124.204.0/24 DeepL SE  194.124.204.71 ip.addr== 194.124.204.0/24||
152.199.21.0/24 Edgecast Inc. 152.199.21.175 ip.addr==152.199.21.0/24||
192.229.221.0/24 Edgecast Inc. 192.229.221.95 ip.addr==192.229.221.0/24||
199.232.188.0/22 Fastly, Inc. Domainhoster ? 173.222.108.226 ip.addr==199.232.188.0/22||
92.223.40.0/24 G-Core Labs S.A. Border Gateway Protocol  92.223.40.62 ip.addr==92.223.40.0/24||
142.250.184.0/24 Google ip.addr==142.250.184.0/24||
142.251.36.0/24 Google ip.addr==142.251.36.0/24||
172.217.16.0/24 Google ip.addr==172.217.16.0/24||
172.217.23.0/24 Google ip.addr==172.217.23.0/24||
216.58.206.0/23 Google ip.addr==216.58.206.0/23||
34.104.0.0/14 Google ip.addr==34.104.0.0/14||
34.108.0.0/14 Google ip.addr==34.108.0.0/14||
34.116.0.0/14 Google 104.18.87.42; 104.18.32.137 ip.addr==34.116.0.0/14||
34.120.0.0/14 Google ip.addr==34.120.0.0/14||
34.148.0.0/14 Google 34.149.100.209 ip.addr==34.148.0.0/14||
34.160.0.0/16 Google ip.addr==34.160.0.0/16||
34.32.0.0/11 Google ip.addr==34.32.0.0/11||
35.244.0.0/16 Google 35.244.181.201 ip.addr==35.244.0.0/16||
66.102.1.0/24 Google 66.102.1.188 ip.addr==66.102.1.0/24||
8.8.8.0/24 Google ip.addr==8.8.8.0/24||
  104.40.0.0/13 Microsoft Win Update  104.40.149.189 ip.addr== 104.40.0.0/13||
  20.192.0.0/10 Microsoft 20.199.58.43; 20.223.36.55 ip.addr== 20.192.0.0/10||
  23.209.208.0/22 Microsoft 23.209.210.54; 4.231.128.59 ip.addr== 23.209.208.0/22||
  4.224.0.0/12 Microsoft 4.231.128.59 ip.addr== 4.224.0.0/12||
  40.76.0.0/14 Microsoft 40.79.173.41 ip.addr== 40.76.0.0/14||
  72.152.0.0/14 Microsoft 72.154.7.113 ip.addr== 72.152.0.0/14||
13.104.0.0/14 Microsoft 13.107.246.45 ip.addr==13.104.0.0/14||
13.107.42.0/24 Microsoft 13.107.42.16 ip.addr==13.107.42.0/24||
13.107.5.0/24 Microsoft 13.107.5.93 ip.addr==13.107.5.0/24||
13.64.0.0/11 Microsoft 13.89.179.10 ip.addr==13.64.0.0/11||
20.0.0.0/11 Microsoft ip.addr==20.0.0.0/11||
20.184.0.0/13 Microsoft 20.190.159.23; 20.190.160.22;20.190.160.67; 20.190.159.75; 20.189.173.25 ip.addr==20.184.0.0/13||
20.192.0.0/10 Microsoft Win Update  20.199.58.43 ip.addr==20.192.0.0/10||
20.40.0.0/13 Microsoft 20.42.73.24 ip.addr==20.40.0.0/13||
20.48.0.0/12 Microsoft 20.50.73.8 ip.addr==20.48.0.0/12||
20.64.0.0/10 Microsoft 20.73.194.208; 20.74.47.205 ip.addr==20.64.0.0/10||
204.79.197.0/24 Microsoft Win Update  204.79.197.222 ip.addr==204.79.197.0/24||
208.84.0.0/21 Microsoft ip.addr==208.84.0.0/21||
28.251.0.0/16 Microsoft 128.251.127.23 ip.addr==28.251.0.0/16||
4.144.0.0/12 Microsoft 4151228221 ip.addr==4.144.0.0/12||
4.208.0.0/12 Microsoft 4208165245 ip.addr==4.208.0.0/12||
4.224.0.0/12 Microsoft 4.231.128.59 ip.addr==4.224.0.0/12||
40.112.0.0/13 Microsoft 40.113.110.67 ip.addr==40.112.0.0/13||
40.126.0.0/18 Microsoft 40.126.31.69 ip.addr==40.126.0.0/18||
40.127.0.0/16 Microsoft 40127240158 ip.addr==40.127.0.0/16||

40.127.0.0/16

 Microsoft 40.127.240.158
48.208.0.0/13 Microsoft 48.209.108.37 ip.addr==48.208.0.0/13||
51.10.0.0/15 Microsoft 51.11.192.48 ip.addr==51.10.0.0/15||
51.104.0.0/15 Microsoft 51.104.136.2 ip.addr==51.104.0.0/15||
51.124.0.0/16 Microsoft 51.124.78.146 ip.addr==51.124.0.0/16||
52.113.194.0/24 Microsoft 52113194132 ip.addr==52.113.194.0/24||
52.120.0.0/14 Microsoft 52.123.128.14 ip.addr==52.120.0.0/14||
52.160.0.0/11 Microsoft 52.168.117.168; 52.168.117.174 ip.addr==52.160.0.0/11||
52.160.0.0/11 Microsoft 52.168.117.175
52.96.0.0/12 Microsoft 52.109.32.97; 52.109.89.117; 52.109.76.240 ip.addr==52.96.0.0/12||
72.144.0.0/14 Microsoft 72.145.26.121; 72.145.35.98 ip.addr==72.144.0.0/14||
72.152.0.0/14 Microsoft 72.153.5.135 ip.addr==72.152.0.0/14||
217.20.57.0/24 Qwilt INC Werbung ip.addr==217.20.57.0/24||

 

Per folgender Formal in Excel kann jetzt ein Filter erzeugt werden um obige IP/Bereich auszufiltern. für jede Zeile einzeln.
=" ip.addr=="&WENN(A2="";B2;TEXT(A2;"0.0.0.0"))&"||"
Alle Zellen danach kopieren  und am Anfang !( und am Ende ) hinfügen. Letztes || noch löschen!

!(ip.addr==134.120.195.249 || ip.addr==13.107.253.45 || ip.addr==150.171.70.254 
|| ip.addr==2.21.79.26 || ip.addr==2.22.89.20 || ip.addr==20.223.36.55 
|| ip.addr==20.31.61.205 || ip.addr==204.79.197.222 || ip.addr==23.11.206.65 
|| ip.addr==23.53.41.243 || ip.addr==23.53.42.26 || ip.addr==52.85.65.70 
|| ip.addr==184.24.77.0/24 || ip.addr==23.216.77.0/24 || ip.addr==23.2.13.0/24 
|| ip.addr==2.21.78.0/23 || ip.addr==2.22.89.0/24 || ip.addr==173.222.108.0/23 
|| ip.addr==184.24.77.0/24 || ip.addr==2.21.22.0/24 || ip.addr==23.32.100.0/22 
|| ip.addr==23.53.40.0/22 || ip.addr==92.123.104.0/24 || ip.addr==96.16.122.0/24 
|| ip.addr==142.250.0.0/15 || ip.addr==18.173.152.0/21 || ip.addr==18.173.184.0/21 
|| ip.addr==18.66.192.0/24 || ip.addr==205.251.198.0/24 || ip.addr==205.251.198.0/24 
|| ip.addr==205.251.199.0/24 || ip.addr==205.251.197.0/24 || ip.addr==104.18.80.0/20 
|| ip.addr==104.18.32.0/24 || ip.addr==192.229.221.0/24 || ip.addr==152.199.21.0/24 
|| ip.addr==199.232.188.0/22 || ip.addr==34.148.0.0/14 || ip.addr==142.250.184.0/24 
|| ip.addr==142.251.36.0/24 || ip.addr==142.251.36.0/24 || ip.addr==172.217.23.0/24 
|| ip.addr==216.58.206.0/23 || ip.addr==34.104.0.0/14 || ip.addr==34.108.0.0/14 
|| ip.addr==34.116.0.0/14 || ip.addr==34.120.0.0/14 || ip.addr==34.160.0.0/16 
|| ip.addr==34.32.0.0/11 || ip.addr==172.217.16.0/24 || ip.addr==8.8.8.0/24 
|| ip.addr==34.120.0.0/14 || ip.addr==34.160.0.0/16 || ip.addr==35.244.0.0/16 
|| ip.addr==66.102.1.0/24 || ip.addr==20.0.0.0/11 || ip.addr==208.84.0.0/21 
|| ip.addr==4.144.0.0/12 || ip.addr==52.113.194.0/24 || ip.addr==13.104.0.0/14 
|| ip.addr==13.107.42.0/24 || ip.addr==13.107.5.0/24 || ip.addr==20.184.0.0/13 
|| ip.addr==20.0.0.0/11 || ip.addr==204.79.197.0/24 || ip.addr==40.112.0.0/13 
|| ip.addr==40.126.0.0/18 || ip.addr==51.124.0.0/16 || ip.addr==52.96.0.0/12 
|| ip.addr==217.20.57.0/24)

Hauptmenü

Anmeldeformular