my $s = "tethereal (proto 6 or 17) and src host suntest1 and dst host suntest2 -w /tmp/dumpfile";
my %info;
$info{srchost} = $1 if $s =~ /\bsrc host (\S+)/;
$info{dsthost} = $1 if $s =~ /\bdst host (\S+)/;
$info{dir} = $1 if $s =~ /\b-w (\S+)/;
if( $s =~ /\(proto (.*?)\)/ ){   # this one needs extra processing
  my $prot = $1;                          # start with the proto string: "6 or 17"
  my @prot = $prot =~ /(\d+)/g;           # pull out the integers:       (6, 17)
  $info{protocol = join ',', @prot;       # create the desired string:   '6,17'
}
# if necessary, validate %info here to make sure you can continue...