combinates tshark with tcpdump

TSHARK does't accept filters when reading from files, so I combinates tshark with tcpdump.

tcpdump -r something.pcap udp and port 53 -w - | tshark -r - -V | less

you know that tshark filter expression is storonger than tcpdump's.

なんだかなぁ(no way)

By the way,
On a server of mine in internet , in half of days captured pcaps,
I watched INVITATION FOR COOPERATIVE ATTACK(?), ( or just scanning).

The values that X indicates is my address , its unique.

Same of Y is others address, some IP values are counted .

15:35:23.621063 IP Y.Y.Y.Y.39760 > X.X.X.X.53: 61442+ [1au] ANY? com. (32)
        0x0000:  4500 003c d431 0000 f011 df80 YYYY YYYY  E..<.1.......^o.
        0x0010:  XXXX XXXX 9b50 0035 0028 d91a f002 0100  ..\..P.5.(......
        0x0020:  0001 0000 0000 0001 0363 6f6d 0000 ff00  .........com....
        0x0030:  0100 0029 1000 0000 0000 0000            ...)........
16:03:59.663147 IP Y.Y.Y.Y.61354 > X.X.X.X.389: UDP, length 52
        0x0000:  4500 0050 25de 4000 3011 85da YYYY YYYY  E..P%.@.0....i..
        0x0010:  XXXX XXXX efaa 0185 003c 03e0 3084 0000  ..\......<..0...
        0x0020:  002d 0201 0163 8400 0000 2404 000a 0100  .-...c....$.....
        0x0030:  0a01 0002 0100 0201 0001 0100 870b 6f62  ..............ob
        0x0040:  6a65 6374 636c 6173 7330 8400 0000 0000  jectclass0......
05:17:40.340904 IP Y.Y.Y.Y.38896 > X.X.X.X.161:  GetRequest(28)  .1.3.6.1.2.1.1.1.0
        0x0000:  4500 0047 d431 0000 ea11 2fe3 YYYY YYYY  E..G.1..../.4I..
        0x0010:  XXXX XXXX 97f0 00a1 0033 0000 3029 0201  ..\......3..0)..
        0x0020:  0104 0670 7562 6c69 63a0 1c02 040c d8a2  ...public.......
        0x0030:  6302 0100 0201 0030 0e30 0c06 082b 0601  c......0.0...+..
        0x0040:  0201 0101 0005 00
08:45:00.966687 IP Y.Y.Y.Y.49139 > X.X.X.X.1900: UDP, length 91
        0x0000:  4500 0077 0000 4000 3211 aa77 YYYY YYYY  E..w..@.2..w....
        0x0010:  XXXX XXXX bff3 076c 0063 d96f 4d2d 5345  ..\....l.c.oM-SE
        0x0020:  4152 4348 202a 2048 5454 502f 312e 310d  ARCH.*.HTTP/1.1.
        0x0030:  0a48 6f73 743a 3233 392e 3235 352e 3235  .Host:239.255.25
        0x0040:  352e 3235 303a 3139 3030 0d0a 5354 3a73  5.250:1900..ST:s
        0x0050:  7364 703a 616c 6c0d 0a4d 616e 3a22 7373  sdp:all..Man:"ss
        0x0060:  6470 3a64 6973 636f 7665 7222 0d0a 4d58  dp:discover"..MX
        0x0070:  3a33 0d0a 0d0a 00

I beleaved all of ip address are masked:-p