protocol_stats
Run aggregate statistics reports on pcap files using tshark's -z option. Get compact summaries of protocol hierarchy, conversations, endpoints, and per-protocol stats.
Instructions
Run a tshark '-z' aggregate-statistics report on a pcap file and return its parsed output. Use this for protocol-hierarchy, conversation, endpoint, and per-protocol stat tables — much more compact than per-packet JSON. Supported (protocol, variant) pairs: conv: eth, ip, ipv6, tcp, udp; dns: tree; endpoints: eth, ip, ipv6, tcp, udp; http: stat, tree; http_req: tree; io: phs, stat; rpc: srt; sip: stat; smb: srt; smb2: srt.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to the .pcap or .pcapng file | |
| protocol | Yes | Stat family: 'io', 'conv', 'endpoints', 'http', 'http_req', 'dns', 'smb', 'smb2', 'rpc', 'sip' | |
| variant | Yes | Variant within the family: e.g. 'phs', 'stat', 'tree', 'srt', 'ip', 'ipv6', 'tcp', 'udp', 'eth' | |
| max_lines | No | Maximum number of output lines to return (default: 100). Conversation/endpoint tables can be very long. |