How to find protocol from display fields
Hi I'm sending tshark json to elk stack to analyze packets. I'm searching for a field that shows me the protocol of flow like FTP. I appreciate any help
You could parse it out of frame.protocols
or specify a list of fields with -e
options including _ws.col.Protocol
.
If you search for _ws.col.Protocol
here on the Q&A site there are examples.
tshark man page
Asked: 2021-03-14 10:33:45 +0000
Seen: 282 times
Last updated: Mar 14 '21