$ nfdump -R nfcapd.202204050815:nfcapd.202204061510 -s ip/bytes -n 512 -q | awk '{print $5}' | sort -V | less