Read captured packets with tshark by providing input pcap fileīy using option -r with tshark, user can read saved pcap file easily. Capture network packets and copy in file traffic-capture.pcapīy using -w options, user can easily copy all output of tshark tool into single file of format pcap. This option displays clean output of single interface. Just type interface name in from of -i option to display traffic dedicated to specific interface. Capture network traffic with tshark by providing interface

If user wants to see the different options available with tshark, just type below command. All tshark commands displayed on your machine You can install tshark just type below command for installation: sudo apt-get install tsharkĬlick Here to know Linux find Command with 20 Examplesġ. Here, I am listing some basic commands with example usage which help you to capture and analyze the network traffic. This guide is for beginners who want to start analyzing protocols and use some basic commands of tshark. This can be used as a substitute for Wireshark if you enjoy working on a black screen. Tshark is a command-line based protocol analyzer tool used to capture and analyze network traffic from a live network.

Wireshark capture examples