This is our old Q&A Site. Please post any new questions and answers at

Hi there,

I'm completely new to wireshark and I would like to know the correct way to determine all of the protocols the are used on the network in a specific capture, please can someone help me?

asked 24 Apr '13, 06:23

harry82's gravatar image

accept rate: 0%

the best way:

Statistics -> Protocol Hierarchy


permanent link

answered 24 Apr '13, 06:51

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

One should add that the Protocol Hierarchy only shows what Wireshark has been able to determine. So if there is a protocol that Wireshark doesn't know or which runs on a port it doesn't recognize, it will not appear in the statistics.

(24 Apr '13, 08:37) Jasper ♦♦

Thank you all for your time, it is most appreciated


(24 Apr '13, 10:16) harry82

Another way (if you're more command-line oriented) is to use "tshark -T fields -eframe.protocols -nr filename.pcap" and then do some work to sort and unique the output. There's even a simple script in the Wireshark source code distribution (tools/ that does this for you. Basically what it does (after error checking, etc.) is:

# Extract the protocol names.
$TSHARK -T fields -eframe.protocols -nr "$CF" 2>/dev/null | tr ':\r' '\n' \
    | sort -u | tr '\n\r' ' '

(Note that this is using the *NIX utilities 'tr' and 'sort' which probably don't exist on Windows unless you have Cygwin installed.)

permanent link

answered 24 Apr '13, 07:19

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 24 Apr '13, 06:23

question was seen: 6,105 times

last updated: 24 Apr '13, 10:26

p​o​w​e​r​e​d by O​S​Q​A