extract from pcap all protocols found

Question

I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark

I think tshark is able to do it, but i couldn't find how. any idea?

Answer 1

I think that -Tfields -eframe.protocols would be the closest thing you'll get.
The output looks something like this:

eth:ip:tcp:http
eth:ip:tcp
eth:ip:tcp:http:media
eth:ip:tcp
eth:ip:udp:nbdgm:smb:browser
eth:ip:tcp
eth:arp
eth:arp
eth:ipv6:udp:http
eth:ip:udp:http

As it can be seen the information displayed will vary a bit depending on which protocol dissector gets to play. So you'll need to do some post-processing to cut the parts you don't need and/or dedup (for instance using @Mark's suggestion in the comment).

Answer 2

Unlike most other tools, Bro detects application protocols in a port-agnostic fashion. For example, it detects HTTP not on just the standard ports (80, 8080, etc.), but in any TCP connection.

Extracting the number of connections (TCP and UDP) is straight-forward:

bro -r trace.pcap
bro-cut service < conn.log | sort | uniq -c

Example output from a small HTTP trace:

 19 -
 53 dns
 34 http

Answer 3

tcpdstat will do this for you. I believe it's mentioned in one of Richard Bejtlich's books.

Answer 4

Have you tried tshark -r test.cap -q -z io,phs

It will give you a hierarchical list of protocols, not sure if it will suite you needs.

===================================================================
Protocol Hierarchy Statistics
Filter: frame

frame                                    frames:433 bytes:290520
  eth                                    frames:433 bytes:290520
    ip                                   frames:433 bytes:290520
      tcp                                frames:423 bytes:289464
        http                             frames:188 bytes:267285
        ssh                              frames:24 bytes:7968
        ssl                              frames:2 bytes:237
      udp                                frames:10 bytes:1056
        data                             frames:6 bytes:355
        ntp                              frames:2 bytes:180
        nbdgm                            frames:2 bytes:521
          smb                            frames:2 bytes:521
            mailslot                     frames:2 bytes:521
              browser                    frames:2 bytes:521
===================================================================

To get just the list of protocols you could do some commandline KungFu.

tshark -r test.cap -z io,phs -q | tr -s ' ' | cut -f 2 -d ' ' | tail -n +7 | head -n -1

which will give you

eth
ip
tcp
http
ssh
ssl
udp
data
ntp
nbdgm
smb
mailslot
browser