tldr/pages/linux/tshark.md

36 lines
723 B
Markdown
Raw Normal View History

2019-02-07 14:27:17 +00:00
# tshark
> Packet analysis tool, CLI version of wireshark.
- Monitor everything on localhost:
`tshark`
2019-09-18 16:09:38 +01:00
- Only capture packets matching a specific capture filter:
`tshark -f '{{udp port 53}}'`
- Only show packets matching a specific output filter:
2019-02-07 14:27:17 +00:00
`tshark -Y '{{http.request.method == "GET"}}'`
- Decode a TCP port using a specific protocol (e.g. HTTP):
`tshark -d tcp.port=={{8888}},{{http}}`
- Specify the format of captured output:
`tshark -T {{json|text|ps|…}}`
- Select specific fields to output:
`tshark -T {{fields|ek|json|pdml}} -e {{http.request.method}} -e {{ip.src}}`
- Write captured packet to a file:
`tshark -w {{path/to/file}}`
- Analyze packets from a file:
`tshark -r {{file_name}}.pcap`