tshark(1)
Capture and analyze network packets from the command line, the non-GUI version of Wireshark.
Synopsis
tshark [OPTIONS] [-i <interface>] [-f <capture filter>] [-Y <display filter>]Description
tshark is a command-line packet analyzer that captures live network traffic or reads packet files and displays packet details. It's the terminal-based counterpart to Wireshark and supports all the same dissectors and filters for deep packet inspection without a graphical interface.
Use tshark to capture packets for debugging network issues, monitoring traffic, or analyzing saved pcap files. You can filter packets during capture or display, customize output format, and extract specific fields for scripting and automation.
Common options
| Flag | What it does |
|---|---|
-i <interface> | specify network interface to capture from (e.g., eth0, en0) |
-f <capture filter> | apply libpcap filter during capture (e.g., -f 'tcp port 80') |
-Y <display filter> | apply Wireshark display filter to show only matching packets |
-r <file> | read and analyze packets from a saved pcap file |
-w <file> | write captured packets to a pcap file |
-c <count> | capture only specified number of packets then stop |
-a duration:<seconds> | stop capture after specified duration in seconds |
-T fields | output packet data as tab-separated fields |
-e <field> | specify fields to display (use with -T fields) |
-n | disable all name resolution (faster, no DNS/MAC lookups) |
-q | quiet mode; suppress protocol tree output |
-l | flush output to stdout after each packet (live output) |
Examples
capture live packets on eth0 and display packet summary
tshark -i eth0capture only HTTPS traffic (port 443) and save to file
tshark -i eth0 -f 'tcp port 443' -w capture.pcapread pcap file and show only HTTP request packets
tshark -r capture.pcap -Y 'http.request' | head -20capture and output only source IP, destination IP, and destination port
tshark -i eth0 -T fields -e ip.src -e ip.dst -e tcp.dstport -nextract DNS query names from a saved capture file
tshark -r capture.pcap -Y 'dns' -e dns.qry.name -T fieldscapture up to 100 packets or 30 seconds, whichever comes first
tshark -i wlan0 -c 100 -a duration:30filter packets for specific IP and output as JSON
tshark -r capture.pcap -Y 'ip.addr==192.168.1.5' -T json > output.jsoncapture TCP SYN packets in quiet mode with minimal output
sudo tshark -i eth0 -f 'tcp syn' -q