add procotol for wireshark cap