What it does
tshark captures, decodes, and analyzes network traffic using the same dissectors as Wireshark, but outputs results in text or structured formats suitable for terminals, scripts, and automation.
How it works (mechanical)
tshark uses libpcap for capture and the Wireshark
dissection engine for protocol decoding. Unlike tcpdump,
decoding happens in user space using protocol-aware parsers.
- Capture: libpcap (same as tcpdump)
- Decode: Wireshark dissectors
- Filtering: capture filters (BPF) and display filters
- Output: human-readable, field-based, JSON, CSV
10 Practical Examples
# 1) List available interfaces tshark -D
# 2) Capture traffic on an interface sudo tshark -i eth0
# 3) Read an existing pcap file tshark -r capture.pcap
# 4) Apply a capture filter (BPF) sudo tshark -i eth0 -f "tcp port 443"
# 5) Apply a display filter (Wireshark syntax) tshark -r capture.pcap -Y "http.request"
# 6) Show specific fields (automation-friendly) tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port
# 7) Output JSON for processing tshark -r capture.pcap -T json
# 8) Increase verbosity / decode detail sudo tshark -i eth0 -V
# 9) Follow a TCP stream tshark -r capture.pcap -z follow,tcp,ascii,0
# 10) Capture Wi-Fi traffic (monitor interface) sudo tshark -i mon0
Notes & Gotchas
- Root privileges are usually required for live capture.
- Display filters are different from capture filters.
- Deep dissection is CPU-intensive on high-throughput links.
- Encrypted traffic is still decoded at the metadata level.
- Large pcaps benefit from filtering before decoding.
Historical Context
tshark was introduced as the command-line counterpart to Wireshark,
enabling protocol-aware analysis in environments without a GUI and making
Wireshark’s dissectors accessible to scripts and servers.
Modern Equivalent / Related Tools
- tcpdump — lightweight packet capture
- wireshark — graphical packet analysis
- dumpcap — high-performance capture engine
- ngrep — regex-based payload matching
- zeek — network security monitoring