wireshark(1)
Wireshark is a graphical network protocol analyzer that captures and displays network traffic in real-time.
Synopsis
wireshark [OPTION]... [FILE]...Description
Wireshark is a powerful GUI tool for capturing, analyzing, and inspecting network packets. It allows you to examine network traffic at the packet level, decode protocols, filter traffic, and save captures for later analysis. Wireshark supports hundreds of protocols and can run on Linux, macOS, Windows, and other operating systems.
You can capture packets from a live network interface or open previously saved capture files. Wireshark displays packets in three panes: the packet list, packet details, and raw packet bytes. Use display filters to focus on specific traffic of interest.
Common options
| Flag | What it does |
|---|---|
-i <interface> | Capture on the specified network interface (e.g., eth0, wlan0) |
-f <capture filter> | Apply a capture filter to reduce noise (e.g., 'tcp port 80') |
-r <file> | Read and display packets from a saved capture file |
-w <file> | Write captured packets to a file (pcap format) |
-k | Start capturing immediately (don't show the interface selection dialog) |
-c <count> | Capture only the specified number of packets, then stop |
-a <duration:seconds> | Stop capturing after the specified number of seconds |
-F <file format> | Set the capture file format (pcap, pcapng, etc.) |
-Y <display filter> | Apply a display filter at startup (e.g., 'http.request') |
-S <sort field> | Sort the packet list by the specified field |
-l | Flush output after printing each packet |
Examples
Start Wireshark with the GUI interface to choose a network interface and begin capturing
wiresharkCapture packets on eth0 and save them to capture.pcap without opening the GUI
wireshark -i eth0 -w capture.pcapOpen a saved capture file and display only HTTPS (TCP port 443) traffic
wireshark -r capture.pcap -Y 'tcp.port == 443'Capture up to 1000 packets on wlan0 containing only HTTP and HTTPS traffic
wireshark -i wlan0 -f 'tcp port 80 or tcp port 443' -c 1000Capture packets on eth0 for 60 seconds and save to hourly_capture.pcap
wireshark -i eth0 -a duration:60 -w hourly_capture.pcapExtract DNS queries from a capture file and display frame numbers and domain names
wireshark -r network.pcap -Y 'dns.qry.name' -T fields -e frame.number -e dns.qry.name