Wireshark · Wireshark-users: Re: [Wireshark-users] How can I obtain the application layer protocol using "tshark -T fields -e ??"

[Daniel Schlosser <schlosser@xxxxxxxxxxxxxxxxxxxxxxxxxxx>]

Thank you all!
That is the option I was looking for.

Kindest regards
Daniel

Am 02.09.2009 um 12:42 schrieb sandeep nitta:

> snitta@snitta-laptop:/root/pcaps$ tshark -r msn.pcap -Tfields -e  
> frame.protocols
> eth:ip:tcp:data
> eth:ip:tcp:data
> eth:ip:tcp
> eth:ip:udp:nbdgm:smb:browser
> eth:ip:udp:nbdgm:smb:browser
> eth:ip:udp:nbdgm:smb:smb_netlogon
> eth:ip:udp:nbdgm:smb:smb_netlogon
> eth:ip:udp:nbdgm:smb:smb_netlogon
> eth:ip:udp:nbdgm:smb:smb_netlogon
> eth:ip:tcp
> eth:ip:tcp
>
>
> But not sure, if this is what you are looking for.
>
>
>
> On Wed, Sep 2, 2009 at 7:43 AM, Martin  
> Visser<martinvisser99@xxxxxxxxx> wrote:
> > Not 100% sure, but I have a feeling the best you can do is "-e
> > "frame.protocols"
> >
> > I don't believe the Protocol (or Info for that matter) column can be
> > extracted here.
> >
> > Regards, Martin
> >
> > MartinVisser99@xxxxxxxxx
> >
> >
> > On Mon, Aug 31, 2009 at 10:15 PM, Daniel Schlosser
> > <schlosser@xxxxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
> > > I'm using "tshark ... -T fields -e ..." to extract information about
> > > the packets of a captured file.
> > > Unfortunately, I couldn't manage to get the protocol, which is
> > > displayed using the -T psml option.
> > > Is there any -e ???? option to get this information?
> > >
> > > Best regards
> > > Daniel
> > >
> > >
> > > ___________________________________________________________________________
> > > Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx 
> > > >
> > > Archives:    http://www.wireshark.org/lists/wireshark-users
> > > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> > >
> > > mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
> >
> >
> > ___________________________________________________________________________
> > Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx 
> > >
> > Archives:    http://www.wireshark.org/lists/wireshark-users
> > Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
> >             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx 
> >
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe