For example, we may wish to examine all traffic associated with a specific IP address or service. When we review a pcap file, there is usually a specific characteristic we are looking for. For example in the first screen capture, I used “head -20” to print the first 20 lines of output.įiltering Traffic With Tshark Capture Filters

For example: tshark -r interesting-packets.pcap | headīy default “head” will show the first 10 lines of output but you can modify this as needed, feeding it the number of lines you want to see as a command-line switch. If you will be printing the output to the screen, I like to pipe the output through “head” (show only a specified number of lines of output) or “less” (show one full page of output at a time) so that it’s easier to read. If you have a pcap file that you wish to process, you can use the “-r” command. Let’s break down some of the components of this command.īy default, tshark will listen on the local interface in order to grab packets off the wire. For reference, here’s the screen capture that started the conversation: I’ll also dive into how these fields can be extracted and manipulated. I had a number of questions around how this works, so I wanted to post a more in-depth blog entry that discusses tshark’s ability to display specific header fields. In a previous blog entry, I referenced using tshark to extract IP header information so that it could be sorted and analyzed. The first blog explains how to extract fields (aka the theory) and the second blog shows you one of the many things you can do with that feature (aka the implementation).

This blog is a merger of two past blogs we did revolving around T-shark.

Tshark https