I have a large pcap file and I have some session about 10 session. But I don't know they're
TCP or UDP. With -Y tshark has tcp.dstport or tcp.scrport.
I have to find out my session is TCP or UDP. How can I find out transmission protocol? How find out my port is TCP or UDP?
ip.src I can access to port src without mention to tcp or udp.
When looking for something in packets that you don't know, start by filtering on what you do know. So, in the search of these sessions, do you know who (which IP address) was generating these sessions? And do you know when these sessions were generated?
You might also take a look at Statistics -> Conversations and browse through the TCP and UDP session list.
If that also does not work, then start filtering out everything that is not the traffic you are looking for. Make a filter not (udp.port in {53 123 [add other ports]} or tcp.port in {80 443 [add other ports]}) to make the list of packets to scroll through smaller. After doing this, you can open up Statistics -> Conversations again and enable Limit to display filter.
Asked: 2022-03-02 06:05:45 +0000
Seen: 1,027 times
Last updated: Mar 03 '22
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
