Update scan.sh

change from ip.src to ip.dst (possibly due to a bug fix in tshark)