Techzone/TShark - Terminal Wireshark

TShark - Terminal Wireshark

3 min readArticle

TShark is the command-line version of Wireshark. Same packet capture and analysis engine, but designed for scripts, automation, headless servers, and remote SSH sessions where you don't have a GUI. Extremely powerful for filtering, extracting specific fields, and processing large captures.

Installation

bash 
sudo apt install tshark
# May need to add user to wireshark group
sudo usermod -aG wireshark $USER

Basic Capture

bash 
# Capture on interface, print summaries
sudo tshark -i eth0

# Capture on wlan0mon (monitor mode)
sudo tshark -i wlan0mon

# Capture to file
sudo tshark -i eth0 -w capture.pcap

# Capture with BPF filter
sudo tshark -i eth0 -f "port 80 or port 443"

# Capture N packets then stop
sudo tshark -i eth0 -c 100

# Capture for N seconds
sudo tshark -i eth0 -a duration:30 -w output.pcap

Reading / Analyzing PCAP Files

bash 
# Read a pcap file
tshark -r capture.pcap

# Apply display filter
tshark -r capture.pcap -Y "http"
tshark -r capture.pcap -Y "tcp.port == 22"
tshark -r capture.pcap -Y "wlan.fc.type_subtype == 0x08"  # Beacon frames

# Count packets matching filter
tshark -r capture.pcap -Y "dns" | wc -l

Display Filters (Common Examples)

bash 
# HTTP traffic
tshark -r file.pcap -Y "http"

# Only HTTP requests
tshark -r file.pcap -Y "http.request"

# Specific host
tshark -r file.pcap -Y "ip.addr == 192.168.1.1"

# TCP SYN packets (new connections)
tshark -r file.pcap -Y "tcp.flags.syn == 1 and tcp.flags.ack == 0"

# DNS queries
tshark -r file.pcap -Y "dns.flags.response == 0"

# WiFi deauth frames
tshark -r wifi.pcap -Y "wlan.fc.type_subtype == 12"

# WPA handshake frames
tshark -r wifi.pcap -Y "eapol"

Extracting Specific Fields

bash 
# Print only source and dest IPs
tshark -r capture.pcap -T fields -e ip.src -e ip.dst

# Extract HTTP hostnames
tshark -r capture.pcap -Y "http.request" -T fields -e http.host

# Extract DNS queries
tshark -r capture.pcap -Y "dns.flags.response == 0" -T fields -e dns.qry.name

# Extract credentials from HTTP (basic auth)
tshark -r capture.pcap -Y "http.authorization" -T fields -e http.authorization

# WiFi SSIDs from beacon frames
tshark -r wifi.pcap -Y "wlan.fc.subtype == 8" -T fields -e wlan.ssid

# Extract URLs
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri

Output Formats

bash 
# Default (text summary)
tshark -r file.pcap

# JSON output
tshark -r file.pcap -T json

# Fields (tab separated)
tshark -r file.pcap -T fields -e ip.src -e ip.dst -e tcp.dstport

# PDML (XML)
tshark -r file.pcap -T pdml

Useful Capture Scenarios

bash 
# Capture WiFi management frames
sudo tshark -i wlan0mon -Y "wlan.fc.type == 0" -w mgmt_frames.pcap

# Capture WPA handshake (look for EAPOL)
sudo tshark -i wlan0mon -Y "eapol" -w handshakes.pcap

# Watch HTTP traffic in real time
sudo tshark -i eth0 -Y "http" -T fields -e ip.src -e http.host -e http.request.uri

# Log all DNS queries with timestamps
sudo tshark -i eth0 -Y "dns.flags.response == 0" -T fields \
  -e frame.time -e ip.src -e dns.qry.name

Post-Capture Processing

bash 
# Extract specific stream to new pcap
tshark -r capture.pcap -Y "ip.addr == 192.168.1.5" -w filtered.pcap

# Follow a TCP stream
tshark -r capture.pcap -q -z follow,tcp,ascii,0

# Protocol statistics
tshark -r capture.pcap -q -z io,phs

See Also

  • pyshark-python-packet-analysis - Python library for parsing tshark output
  • tcpdump-packet-capture - Lighter alternative for quick capture
  • scapy-packet-crafting - Craft and inject packets
techzonesite.comUnlock Your IT Potential