I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark
I think tshark is able to do it, but i couldn't find how. any idea?
I think that
-Tfields -eframe.protocols would be the closest thing you'll get.
The output looks something like this:
As it can be seen the information displayed will vary a bit depending on which protocol dissector gets to play. So you'll need to do some post-processing to cut the parts you don't need and/or dedup (for instance using @Mark's suggestion in the comment).
Have you tried
tshark -r test.cap -q -z io,phs
It will give you a hierarchical list of protocols, not sure if it will suite you needs.
Protocol Hierarchy Statistics
frame frames:433 bytes:290520
eth frames:433 bytes:290520
ip frames:433 bytes:290520
tcp frames:423 bytes:289464
http frames:188 bytes:267285
ssh frames:24 bytes:7968
ssl frames:2 bytes:237
udp frames:10 bytes:1056
data frames:6 bytes:355
ntp frames:2 bytes:180
nbdgm frames:2 bytes:521
smb frames:2 bytes:521
mailslot frames:2 bytes:521
browser frames:2 bytes:521
To get just the list of protocols you could do some commandline KungFu.
tshark -r test.cap -z io,phs -q | tr -s ' ' | cut -f 2 -d ' ' | tail -n +7 | head -n -1
which will give you
tcpdstat will do this for you. I believe it's mentioned in one of Richard Bejtlich's books.
Unlike most other tools, Bro detects application protocols in a port-agnostic fashion. For example, it detects HTTP not on just the standard ports (80, 8080, etc.), but in any TCP connection.
Extracting the number of connections (TCP and UDP) is straight-forward:
bro -r trace.pcap
bro-cut service < conn.log | sort | uniq -c
Example output from a small HTTP trace: