$ tshark -r ubuntu-telnet.pcap -n -Y 'ip.src==192.168.100.20 && telnet.data' -T fields -e frame.number -e telnet.data 22 telnetdemo\r 27 TelnetIsPlaintext\r 40 w\r 45 exit\r $ tshark -r ubuntu-telnet-no27.pcap -n -x 0000 52 54 00 9b cb ec 52 54 00 3b a6 5b 08 00 45 00 RT....RT.;.[..E. 0010 00 46 39 44 40 00 40 06 b7 fe c0 a8 64 14 c0 a8 .F9D@.@.....d... 0020 64 0a 8a e4 00 17 8d 63 fa f2 92 5d 74 f7 80 18 d......c...]t... 0030 00 fb 8d 50 00 00 01 01 08 0a 33 01 40 c2 2e be ...P......3.@... 0040 78 34 54 65 6c 6e 65 74 49 73 50 6c 61 69 6e 74 x4TelnetIsPlaint 0050 65 78 74 0d ext. $ tshark -r ubuntu-telnet.pcap -n -Y 'tcp.port==22 && frame contains "TelnetIsPlaintext"' | wc -l 0 $ tshark -r ubuntu-telnet.pcap -n -Y 'ssh.protocol' -T fields -e frame.number -e ip.src -e ssh.protocol 62 192.168.100.20 SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.5 64 192.168.100.10 SSH-2.0-OpenSSH_10.2p1 Ubuntu-2ubuntu3.5 $ tshark -r ubuntu-telnet-no74.pcap -n -x 0000 52 54 00 9b cb ec 52 54 00 3b a6 5b 08 00 45 b8 RT....RT.;.[..E. 0010 00 88 97 ae 40 00 40 06 58 9a c0 a8 64 14 c0 a8 ....@.@.X...d... 0020 64 0a 80 bc 00 16 50 bf 95 d5 93 3b 05 b2 80 18 d.....P....;.... 0030 01 01 94 85 00 00 01 01 08 0a 53 3a 79 f6 5c c6 ..........S:y.\. 0040 25 61 00 00 00 0c 0a 15 00 00 00 00 00 00 00 00 %a.............. 0050 00 00 01 28 41 dc e0 7e 4d fe c6 7e 1a e2 a3 3a ...(A..~M..~...: 0060 d0 52 39 09 3e af 3c 1f 14 8e d1 bd 1c 2d 65 e4 .R9.>.<......-e. 0070 1f 90 c9 75 3f f2 fb b7 cc 2e 36 04 61 b9 37 6e ...u?.....6.a.7n 0080 45 25 45 53 ed 1c e9 76 9b 09 5f 15 90 ea 48 72 E%ES...v.._...Hr 0090 85 22 04 a7 dc 9b ."....