Tshark - TShark is the command-line version of Wireshark
It performs similar network packet capture and analysis functions but without a graphical user interface. It is widely used for network monitoring, troubleshooting, and security analysis, especially in environments where a GUI is not available.
Examples :
Capture packets on an interface:
tshark -i eth0
Capture and display only HTTP traffic:
tshark -i eth0 -f "tcp port 80"
Capture packets and save to a file:
tshark -i eth0 -w capture.pcap
Display DNS queries:
tshark -i eth0 -Y "dns"
Output capture to JSON format:
tshark -i eth0 -T json
Key Options:
-i -> interface selection : Specifies the network interface to capture packets
Example: tshark -i eth0
-D -> Get list of interfaces : we get output , that you get all list of interfaces
Example: tshark -D
-f -> capture filter : Specifies a filter for the packets captured at the interface level.
Example : tshark -i eth0 -f "tcp port 80"
-Y -> display filter : Filters the packets after capture (similar to Wireshark's display filters).
Example : tshark -i eth0 -Y "http"
-w -> write output to the file: Writes the captured packets to a file in PCAP format, which can be opened later in Wireshark.
Example : tshark -i eth0 -w capture.pcap
For More Info: https://www.securitymanadhey.com/p/tshark-tshark-is-command-line-version.html
