L print list of link-layer types of iface and exit time-stamp-type timestamp method for interface y link layer type (def: first appropriate) s packet snapshot length (def: appropriate maximum ) f packet filter in libpcap filter syntax i name or idx of interface (def: first non-loopback ) Type the following command to install tshark in Ubuntu/Debian using apt-get: However, for the time being, we will learn how it works, what are its attributes, and how you can utilize it to the best of its capabilities.

The best you can do is to use tshark to set up a port in your server that forwards information to your system, so you can capture traffic for analysis using a GUI. Even though both tools are almost equivalent in traffic capturing functionality, tshark is a lot more powerful. Important to note that tshark is sometimes used as a substitute for tcpdump. Hence, at some point in time, as a network administrator or a security engineer, you will have to use a command-line interface. The terminal version of Wireshark supports similar options and is a lot useful when a Graphical User Interface (GUI) isn’t available.Įven though a graphical user interface is, theoretically, a lot easier to use, not all environments support it, especially server environments with only command-line options. In this article, we will understand and cover a command-line interface for Wireshark, i.e., tshark. In the earlier tutorials for Wireshark, we have covered fundamental to advanced level topics.

Wireshark pcap filter on port