Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark

I think tshark is able to do it, but i couldn't find how. any idea?

share|improve this question
    
this might be a cool site to track to help with pcap analyses pcapr.net/xtractr –  Tate Hansen May 15 '11 at 7:00
    
yes i love pcapr but it is for a internal project, i cannot use them :-/ –  VP. May 16 '11 at 9:47
    
Xplico can be used to that goal. –  user3056 Jun 23 '11 at 16:48
add comment

4 Answers

up vote 9 down vote accepted

I think that -Tfields -eframe.protocols would be the closest thing you'll get.
The output looks something like this:

eth:ip:tcp:http
eth:ip:tcp
eth:ip:tcp:http:media
eth:ip:tcp
eth:ip:udp:nbdgm:smb:browser
eth:ip:tcp
eth:arp
eth:arp
eth:ipv6:udp:http
eth:ip:udp:http

As it can be seen the information displayed will vary a bit depending on which protocol dissector gets to play. So you'll need to do some post-processing to cut the parts you don't need and/or dedup (for instance using @Mark's suggestion in the comment).

share|improve this answer
2  
I'd +1 if I had any votes left for the day. Might want to do tshark -r test.cap -Tfields -eframe.protocols | sort | uniq so you only get a list uniq entries. –  Mark Davidson May 6 '11 at 16:11
    
i think i will choose this one. i liked the tcpdstat, and i think i will use it, but since my question was about the tshark, i think this result is the best, for my needs, using tshark. –  VP. May 6 '11 at 20:41
add comment

Unlike most other tools, Bro detects application protocols in a port-agnostic fashion. For example, it detects HTTP not on just the standard ports (80, 8080, etc.), but in any TCP connection.

Extracting the number of connections (TCP and UDP) is straight-forward:

bro -r trace.pcap
bro-cut service < conn.log | sort | uniq -c

Example output from a small HTTP trace:

 19 -
 53 dns
 34 http
share|improve this answer
add comment

tcpdstat will do this for you. I believe it's mentioned in one of Richard Bejtlich's books.

share|improve this answer
    
i will check it. looks good. –  VP. May 6 '11 at 19:39
add comment

Have you tried tshark -r test.cap -q -z io,phs

It will give you a hierarchical list of protocols, not sure if it will suite you needs.

===================================================================
Protocol Hierarchy Statistics
Filter: frame

frame                                    frames:433 bytes:290520
  eth                                    frames:433 bytes:290520
    ip                                   frames:433 bytes:290520
      tcp                                frames:423 bytes:289464
        http                             frames:188 bytes:267285
        ssh                              frames:24 bytes:7968
        ssl                              frames:2 bytes:237
      udp                                frames:10 bytes:1056
        data                             frames:6 bytes:355
        ntp                              frames:2 bytes:180
        nbdgm                            frames:2 bytes:521
          smb                            frames:2 bytes:521
            mailslot                     frames:2 bytes:521
              browser                    frames:2 bytes:521
===================================================================

To get just the list of protocols you could do some commandline KungFu.

tshark -r test.cap -z io,phs -q | tr -s ' ' | cut -f 2 -d ' ' | tail -n +7 | head -n -1

which will give you

eth
ip
tcp
http
ssh
ssl
udp
data
ntp
nbdgm
smb
mailslot
browser
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.