I am using the following command to output IPs from live tcpdump capture
sudo tcpdump -nn -q ip -l | awk \'{print $3; fflush(stdout)}\' >> ips.txt <
sudo tcpdump -nn -q ip -l | awk \'{print $3; fflush(stdout)}\' >> ips.txt
While I'm a huge Awk fan, it's worthwhile having alternatives. Consider this example using cut:
tcpdump -n ip | cut -d ' ' -f 3 | cut -d '.' -f 1-4 | sort | uniq