Reading captured packet from command line with tcpdump - shell

Question

I am capturing traffic using:
tcpdump -i <interface> -nn -s0 -w ike2.pcap
Then I am reading the captured file using:
tcpdump -vvv -l -r ike2.pcap
While reading, the first packet is getting displayed as:
07:22:33.320142 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], length: 296) 10.0.0.1.isakmp > 10.0.0.2.isakmp: [udp sum ok] isakmp 2.0 msgid cookie ->: phase 1 I #34[]:
(#33)
(#34)
(#40)
(#41)
(#41)
I need to get the details of this packet. In this ISAKMP IKEv2 packet, I am interested to extract the values of 'Encryption Algorithm' and 'Integrity Algorithm' (i.e 'ENCR_3DES' and 'AUTH_HMAC_MD5_96')
I can view the values if I inspect the packet in wireshark. But, I have to do this from a shell script, so I cannot use wireshark. I need to get these values from tcpdump read command itself.
I am assuming there might be some way to print the encryption and integrity algorithms used from tcpdump read command. Could you please help to figure this out.
Captured packet:

Answer 1

Could find the way to do it as you are expecting with only tcpdump, but has #user862787 said use tshark like:
# tshark -V -r somecapfile.pcap
Frame 1: 196 bytes on wire (1568 bits), 196 bytes captured (1568 bits)
Encapsulation type: Linux cooked-mode capture (25)
Arrival Time: May 10, 2017 02:00:34.811347000 CDT
[Time shift for this packet: 0.000000000 seconds]
Epoch Time: 1494399634.811347000 seconds
[Time delta from previous captured frame: 0.000000000 seconds]
[Time delta from previous displayed frame: 0.000000000 seconds]
[Time since reference or first frame: 0.000000000 seconds]
Frame Number: 1
Frame Length: 196 bytes (1568 bits)
Capture Length: 196 bytes (1568 bits)
[Frame is marked: False]
[Frame is ignored: False]
[Protocols in frame: sll:ethertype:ip:sctp:m3ua:sccp:tcap:gsm_map]
The -V does what you want!

Answer 2

I can view the values if I inspect the packet in wireshark. But, I have to do this from a shell script, so I cannot use wireshark.
But you could perhaps use TShark.

Answer 3

tcpdump -r file with some other flags (-X, for example).