Linux command
tshark 命令
文本
复制后可按需替换文件名、目录或参数。
常用示例
Monitor
tshark
Example
tshark -f 'udp port 53'
Example
tshark -Y 'http.request.method == "GET"'
Decode
tshark -d tcp.port==8888,http
Example
tshark -T [json|text|ps]
Example
tshark -T fields -e http.request.method -e ip.src
Write
tshark -w [path/to/file]
Analyze
tshark -r [path/to/file.pcap]
说明
tshark is the command-line version of Wireshark, providing network packet capture and analysis capabilities. It can capture live traffic from network interfaces, read packets from capture files, and decode protocol data. The tool supports both capture filters (BPF syntax, applied during capture) and display filters (Wireshark syntax, applied to output). It can output data in various formats including text, JSON, and PDML for further processing.
参数
- -i _interface_
- Capture on specified interface
- -f _filter_
- Capture filter (BPF syntax)
- -Y _filter_
- Display filter (Wireshark syntax)
- -r _file_
- Read packets from file
- -w _file_
- Write packets to file
- -T _format_
- Output format (text, json, pdml, ps, fields, etc.)
- -e _field_
- Field to print (with -T fields/json/pdml)
- -d _spec_
- Decode as protocol (e.g., tcp.port==8080,http)
- -c _count_
- Stop after capturing count packets
- -a _condition_
- Autostop condition (duration:sec, filesize:KB)
- -V
- Verbose output (packet tree)
- -x
- Print hex dump of packet data
- -q
- Quiet mode (less output)
FAQ
What is the tshark command used for?
tshark is the command-line version of Wireshark, providing network packet capture and analysis capabilities. It can capture live traffic from network interfaces, read packets from capture files, and decode protocol data. The tool supports both capture filters (BPF syntax, applied during capture) and display filters (Wireshark syntax, applied to output). It can output data in various formats including text, JSON, and PDML for further processing.
How do I run a basic tshark example?
Run `tshark` in a terminal, then adjust file names, paths, flags, or remote targets for your system.
What does -i _interface_ do in tshark?
Capture on specified interface