> For the complete documentation index, see [llms.txt](https://sarpers-organization.gitbook.io/ctftricks/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://sarpers-organization.gitbook.io/ctftricks/_chapter-intro-5/pcap-analysis/trick-0344.md).

# Extract Associated Domains from PCAP (Brim)

***

Brim is often used to analyze Zeek logs, which categorize network events into different log types identified by the `_path` field, such as `conn` for network connections or `http` for HTTP traffic. To analyze specific events, you can filter logs based on these paths and other fields.

To filter connection logs for a specific destination IP address and then extract and count unique hostnames associated with that IP, you can use a query pipeline. For example, using the IP address `176.119.156.128`:

```
_path=="conn" | id.resp_h==176.119.156.128 | cut id.resp_h, host | uniq -c
```

This query first filters for connection logs using `_path=="conn"`. It then applies the filter `id.resp_h==176.119.156.128` to select traffic involving the specific IP. The `cut` operator is used to extract the `id.resp_h` and `host` fields from the filtered logs. Finally, `uniq -c` processes these cut fields. The `uniq -c` operator will prepend each output line (each unique combination of IP and host) with the number of times that specific combination occurred in the input. This effectively shows which domains communicated with the target IP and how many times within the filtered traffic.

For instance, applying the `cut id.resp_h, host | uniq -c` pattern to HTTP logs (`_path=="http"`) would count unique destination IP and host pairs seen in HTTP traffic:

```
_path=="http" | cut id.resp_h, host | uniq -c
```

To see the most frequent occurrences first, you can pipe the output to `sort -r`:

```
_path=="conn" | id.resp_h==176.119.156.128 | cut id.resp_h, host | uniq -c | sort -r
```

This sorts the results in reverse order based on the count. You could further refine this by piping to `head` to see only the top results.