9

I have some pcap files, and i would like just to get a list of protocols that are present on that pcap file. I would like it in a batch mode, not using wireshark

I think tshark is able to do it, but i couldn't find how. any idea?

Improve this question
3
  • this might be a cool site to track to help with pcap analyses pcapr.net/xtractr
    – Tate Hansen
    Commented May 15, 2011 at 7:00
  • yes i love pcapr but it is for a internal project, i cannot use them :-/
    – VP.
    Commented May 16, 2011 at 9:47
  • Xplico can be used to that goal.
    – user3056
    Commented Jun 23, 2011 at 16:48

4 Answers 4

Reset to default
10

I think that -Tfields -eframe.protocols would be the closest thing you'll get.
The output looks something like this:

eth:ip:tcp:http
eth:ip:tcp
eth:ip:tcp:http:media
eth:ip:tcp
eth:ip:udp:nbdgm:smb:browser
eth:ip:tcp
eth:arp
eth:arp
eth:ipv6:udp:http
eth:ip:udp:http

As it can be seen the information displayed will vary a bit depending on which protocol dissector gets to play. So you'll need to do some post-processing to cut the parts you don't need and/or dedup (for instance using @Mark's suggestion in the comment).

Improve this answer
2
  • 2
    I'd +1 if I had any votes left for the day. Might want to do tshark -r test.cap -Tfields -eframe.protocols | sort | uniq so you only get a list uniq entries.
    – Mark Davidson
    Commented May 6, 2011 at 16:11
  • i think i will choose this one. i liked the tcpdstat, and i think i will use it, but since my question was about the tshark, i think this result is the best, for my needs, using tshark.
    – VP.
    Commented May 6, 2011 at 20:41
10

Have you tried tshark -r test.cap -q -z io,phs

It will give you a hierarchical list of protocols, not sure if it will suite you needs.

===================================================================
Protocol Hierarchy Statistics
Filter: frame

frame                                    frames:433 bytes:290520
  eth                                    frames:433 bytes:290520
    ip                                   frames:433 bytes:290520
      tcp                                frames:423 bytes:289464
        http                             frames:188 bytes:267285
        ssh                              frames:24 bytes:7968
        ssl                              frames:2 bytes:237
      udp                                frames:10 bytes:1056
        data                             frames:6 bytes:355
        ntp                              frames:2 bytes:180
        nbdgm                            frames:2 bytes:521
          smb                            frames:2 bytes:521
            mailslot                     frames:2 bytes:521
              browser                    frames:2 bytes:521
===================================================================

To get just the list of protocols you could do some commandline KungFu.

tshark -r test.cap -z io,phs -q | tr -s ' ' | cut -f 2 -d ' ' | tail -n +7 | head -n -1

which will give you 

eth
ip
tcp
http
ssh
ssl
udp
data
ntp
nbdgm
smb
mailslot
browser
Improve this answer
3

tcpdstat will do this for you. I believe it's mentioned in one of Richard Bejtlich's books.

Improve this answer
1
  • i will check it. looks good.
    – VP.
    Commented May 6, 2011 at 19:39
2

Unlike most other tools, Bro detects application protocols in a port-agnostic fashion. For example, it detects HTTP not on just the standard ports (80, 8080, etc.), but in any TCP connection.

Extracting the number of connections (TCP and UDP) is straight-forward:

bro -r trace.pcap
bro-cut service < conn.log | sort | uniq -c

Example output from a small HTTP trace:

 19 -
 53 dns
 34 http
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .