Re: Printing the protocol identification from command line

[Abhik Sarkar <sarkar.abhik () gmail com>]

frame.protocols?

On Tue, May 25, 2010 at 2:22 PM, Galloth <lordgalloth () gmail com> wrote:

> Greetings to all,
> I am writing a script for some packet processing and I would like to
> use wireshark/tshark to identify the protocol. I need write source ip,
> source port, destination ip, destination port, and the protocol
> identification for every packet from the given pcap file. I though
> about using tshar with -e parameter:
>
> tshark -T fields -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport -e
> protocol
>
> Unfortunatelly I was not able to wind the name of the field, that
> contains the result of the protocol identification. I would be
> gratefull If somebody could tell me the correct name of the field with
> the information about recognised protocol.
>
> Thank you very much
> --
> Jan Kastil
> galloth () jabbim cz
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request () wireshark org
> ?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe