Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark

I think tshark is able to do it, but i couldn't find how. any idea?

share|improve this question
this might be a cool site to track to help with pcap analyses – Tate Hansen May 15 '11 at 7:00
yes i love pcapr but it is for a internal project, i cannot use them :-/ – VP. May 16 '11 at 9:47
Xplico can be used to that goal. – user3056 Jun 23 '11 at 16:48
up vote 9 down vote accepted

I think that -Tfields -eframe.protocols would be the closest thing you'll get.
The output looks something like this:


As it can be seen the information displayed will vary a bit depending on which protocol dissector gets to play. So you'll need to do some post-processing to cut the parts you don't need and/or dedup (for instance using @Mark's suggestion in the comment).

share|improve this answer
I'd +1 if I had any votes left for the day. Might want to do tshark -r test.cap -Tfields -eframe.protocols | sort | uniq so you only get a list uniq entries. – Mark Davidson May 6 '11 at 16:11
i think i will choose this one. i liked the tcpdstat, and i think i will use it, but since my question was about the tshark, i think this result is the best, for my needs, using tshark. – VP. May 6 '11 at 20:41

Have you tried tshark -r test.cap -q -z io,phs

It will give you a hierarchical list of protocols, not sure if it will suite you needs.

Protocol Hierarchy Statistics
Filter: frame

frame                                    frames:433 bytes:290520
  eth                                    frames:433 bytes:290520
    ip                                   frames:433 bytes:290520
      tcp                                frames:423 bytes:289464
        http                             frames:188 bytes:267285
        ssh                              frames:24 bytes:7968
        ssl                              frames:2 bytes:237
      udp                                frames:10 bytes:1056
        data                             frames:6 bytes:355
        ntp                              frames:2 bytes:180
        nbdgm                            frames:2 bytes:521
          smb                            frames:2 bytes:521
            mailslot                     frames:2 bytes:521
              browser                    frames:2 bytes:521

To get just the list of protocols you could do some commandline KungFu.

tshark -r test.cap -z io,phs -q | tr -s ' ' | cut -f 2 -d ' ' | tail -n +7 | head -n -1

which will give you

share|improve this answer

tcpdstat will do this for you. I believe it's mentioned in one of Richard Bejtlich's books.

share|improve this answer
i will check it. looks good. – VP. May 6 '11 at 19:39

Unlike most other tools, Bro detects application protocols in a port-agnostic fashion. For example, it detects HTTP not on just the standard ports (80, 8080, etc.), but in any TCP connection.

Extracting the number of connections (TCP and UDP) is straight-forward:

bro -r trace.pcap
bro-cut service < conn.log | sort | uniq -c

Example output from a small HTTP trace:

 19 -
 53 dns
 34 http
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.