Tshark
Last modified: 2023-02-13
Network
Tshark is a terminal-oriented version of Wireshark. It's a network protocol analyzer.
Basic Commands
# -r: Input file
tshark -r example.pcapng
# Number of packets
tshark -r example.pcapng | wc -l
# -Y: Filter
tshark -r example.pcapng -Y "http.user_agent"
# -T: Format of text output
# -e: Field name
tshark -r example.pcapng -Y "dns.qry.type == 1" -T fields -e dns.qry.name
tshark -r example.pcapng -Y "dns.flags.response == 0" -T fields -e dns.id