How to find protocol from display fields

tshark
elk

asked 2021-03-14 10:33:45 +0000

emahdij
1 ●1

Hi I'm sending tshark json to elk stack to analyze packets. I'm searching for a field that shows me the protocol of flow like FTP. I appreciate any help

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2021-03-14 15:09:30 +0000

Chuckc
3023 ●6 ●608 ●20

updated 2021-03-14 15:10:06 +0000

You could parse it out of frame.protocols or specify a list of fields with -e options including _ws.col.Protocol.
If you search for _ws.col.Protocol here on the Q&A site there are examples.
tshark man page

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-03-14 10:33:45 +0000

Seen: 285 times

Last updated: Mar 14 '21

How to find protocol from display fields edit

1 Answer