Firmware: 10790+
To get a list of unique encapsulation/protocol “stacks” in a PCAP and the number of times they occur in that PCAP in a human-friendly histogram:
cat my_packets.pcap | protoscope --proto=only | json2histo Protocol
# Or use stream_cat. Any standard output a.k.a. stdout will work:
sudo stream_cat my_packets | protoscope --proto=only | json2histo ProtocolExample output:
Protocol (84)
eth:ipv4:udp 84 (0.832): ****************************************************************************************************
eth:ipv4:tcp 9 (0.921): **********
eth:vlan:ipv4:udp 5 (0.970): *****
eth:vlan:ipv4:tcp 2 (0.990): **
eth:ipv4 1 (1.000): *