How to find protocol from display fields
Hi I'm sending tshark json to elk stack to analyze packets. I'm searching for a field that shows me the protocol of flow like FTP. I appreciate any help
1 Answer
- Sort by
oldest newest most voted
0
You could parse it out of frame.protocols or specify a list of fields with -e options including _ws.col.Protocol.
If you search for _ws.col.Protocol here on the Q&A site there are examples.
tshark man page
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments