$_ = "tethereal (proto 6 or 17) and src host suntest1 and dst host suntest2 -w /tmp/dumpfile";

( /\(proto ([^)]+)\) and src host (\S+) and dst host (\S+) -w (\S+)/ )
    and ( $protocol, $srchost, $dsthost, $dir ) = ($1,$2,$3,$4);

$protocol =~ s/ or /,/g;