I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark
I think tshark is able to do it, but i couldn't find how. any idea?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.Sign up to join this community
I think that
-Tfields -eframe.protocols would be the closest thing you'll get.
The output looks something like this:
eth:ip:tcp:http eth:ip:tcp eth:ip:tcp:http:media eth:ip:tcp eth:ip:udp:nbdgm:smb:browser eth:ip:tcp eth:arp eth:arp eth:ipv6:udp:http eth:ip:udp:http
As it can be seen the information displayed will vary a bit depending on which protocol dissector gets to play. So you'll need to do some post-processing to cut the parts you don't need and/or dedup (for instance using @Mark's suggestion in the comment).
Have you tried
tshark -r test.cap -q -z io,phs
It will give you a hierarchical list of protocols, not sure if it will suite you needs.
=================================================================== Protocol Hierarchy Statistics Filter: frame frame frames:433 bytes:290520 eth frames:433 bytes:290520 ip frames:433 bytes:290520 tcp frames:423 bytes:289464 http frames:188 bytes:267285 ssh frames:24 bytes:7968 ssl frames:2 bytes:237 udp frames:10 bytes:1056 data frames:6 bytes:355 ntp frames:2 bytes:180 nbdgm frames:2 bytes:521 smb frames:2 bytes:521 mailslot frames:2 bytes:521 browser frames:2 bytes:521 ===================================================================
To get just the list of protocols you could do some commandline KungFu.
tshark -r test.cap -z io,phs -q | tr -s ' ' | cut -f 2 -d ' ' | tail -n +7 | head -n -1
which will give you
eth ip tcp http ssh ssl udp data ntp nbdgm smb mailslot browser
tcpdstat will do this for you. I believe it's mentioned in one of Richard Bejtlich's books.
Unlike most other tools, Bro detects application protocols in a port-agnostic fashion. For example, it detects HTTP not on just the standard ports (80, 8080, etc.), but in any TCP connection.
Extracting the number of connections (TCP and UDP) is straight-forward:
bro -r trace.pcap bro-cut service < conn.log | sort | uniq -c
Example output from a small HTTP trace:
19 - 53 dns 34 http