In diary entry “TShark & jq”, I mention that a single packet can have more than one ip.src entry.
Article Link: TShark & Multiple IP AddressesTShark & Multiple IP Addresses, Author: Didier StevensSANS Internet Storm Centerisc, sans, internet, security, threat, worm, virus, phishing, hacking, vulnerability