This short tutorial equipped you to use tshark to analyze network traffic. Capture only specific protocol network packetsīelow example shows how you can filter specific protocols while displaying the results of the tool tshark. If you want to filter traffic based on specific IP, use -f option.

This is the most used command by security researchers and network engineers. Capture only packets from the specific source or destination IP If you have a doubt about the number of available interfaces, use -D option. List out all the interfaces available to capture the network traffic tshark -c -i Ĭlick Here to understand IoT Security 8. Tshark tool provides flexibility to the user to display the specific number of captured packets. Just check the version of tshark tool by using the -v options tshark -vħ. Below command helps you to capture traffic for a particular duration. If user wants to capture network traffic from the live network for a specific period of time, just use -a option. Read captured packets with tshark by providing input pcap fileīy using option -r with tshark, the user can read saved pcap file easily. Capture network packets and copy them in file traffic-capture.pcapīy using -w options, the user can easily copy all output of tshark tool into a single file of format pcap. This option displays the clean output of a single interface. Just type the interface name in from of -i option to display traffic dedicated to a specific interface. Capture network traffic with tshark by providing an interface If the user wants to see the different options available with tshark, just type the below command. All tshark commands displayed on your machine

You can install tshark just type the below command for installation: sudo apt-get install tsharkĬlick Here to know Linux find Command with 20 Examples 1. Here, I am listing some basic commands with example usage that help capture and analyzes the network traffic. This guide is for beginners who want to start analyzing protocols and use some basic commands of tshark. This can be used as a substitute for Wireshark if you enjoy working on a black screen. Tshark is a command-line-based protocol analyzer tool used to capture and analyze network traffic from a live network.

Wireshark command line examples