Analyzing Wireshark PCAPS?


#1

Hi

I have a bunch or pcaps they are an hours worth of capture from our network, what I need to to is analyze them getting information like:

Number of packets of each protocol IE
HTTP 20000 packets 40gb
HTTPS 100000 packets 20gb
ARP 100000 packets 5gb

etc…

is there such a tool to do this ?


#2

Wireshark itself has this capability. What you are looking for is a statistical analysis on your packet captures. This link explains how to utilize some of these features http://www.wireshark.org/docs/wsug_html_chunked/ChUseStatisticsMenuSection.html. Specifically you probably want to look at the Protocol Hierarchy.