Wireshark-users: Re: [Wireshark-users] How can I obtain the application layer protocol using "tshark -T fields -e ??"

From: sandeep nitta <sandeep.nitta@xxxxxxxxx>
Date: Wed, 2 Sep 2009 16:12:14 +0530

snitta@snitta-laptop:/root/pcaps$ tshark -r msn.pcap -Tfields -e frame.protocols
eth:ip:tcp:data
eth:ip:tcp:data
eth:ip:tcp
eth:ip:udp:nbdgm:smb:browser
eth:ip:udp:nbdgm:smb:browser
eth:ip:udp:nbdgm:smb:smb_netlogon
eth:ip:udp:nbdgm:smb:smb_netlogon
eth:ip:udp:nbdgm:smb:smb_netlogon
eth:ip:udp:nbdgm:smb:smb_netlogon
eth:ip:tcp
eth:ip:tcp


But not sure, if this is what you are looking for.



On Wed, Sep 2, 2009 at 7:43 AM, Martin Visser<martinvisser99@xxxxxxxxx> wrote:
> Not 100% sure, but I have a feeling the best you can do is "-e
> "frame.protocols"
>
> I don't believe the Protocol (or Info for that matter) column can be
> extracted here.
>
> Regards, Martin
>
> MartinVisser99@xxxxxxxxx
>
>
> On Mon, Aug 31, 2009 at 10:15 PM, Daniel Schlosser
> <schlosser@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>>
>> I'm using "tshark ... -T fields -e ..." to extract information about
>> the packets of a captured file.
>> Unfortunately, I couldn't manage to get the protocol, which is
>> displayed using the -T psml option.
>> Is there any -e ???? option to get this information?
>>
>> Best regards
>> Daniel
>>
>>
>> ___________________________________________________________________________
>> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
>> Archives:    http://www.wireshark.org/lists/wireshark-users
>> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>>
>> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>