For ad-hoc reports, I would normally do this with minimal Unix tools: tcpdump
and awk
.
First collect broadcasters with ether address:
$ sudo tcpdump -en broadcast > /tmp/NOISY
This makes a file with a line per packet. Use a different tcpdump filter if you want ip broadcasts or some other restriction. The file will have lots of these:
21:39:49.028308 90:fb:a6:31:91:3e > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 60: 192.168.0.32.3483 > 255.255.255.255.3483: UDP, length 16
21:40:01.862984 34:02:86:7f:e7:dc > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 187: 192.168.0.27.17500 > 255.255.255.255.17500: UDP, length 145
...
Then you use awk
to get the second field (ether address), sort them, count the unique values, and sort by numeric count:
$ awk '{ print $2; }' /tmp/NOISY | sort | uniq -c | sort -n
1 90:fb:a6:31:91:3e
2 34:02:86:7f:e7:dc
5 ec:e1:a9:cd:58:22
If you're using wireshark, you can just print the ethernet source addresses, so you'd do something like this:
$ sudo tshark -n -e eth.src -Tfields broadcast > /tmp/NOISY
$ cat /tmp/NOISY | sort | uniq -c | sort -n