Tshark

From aldeid
Jump to navigation Jump to search

Description

tshark is the equivalent of Wireshark in based on the Command Line Interface (CLI).

Installation

# apt-get install tshark

Usage

Options

Incomplete.png
INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Capture filters

Incomplete.png
INCOMPLETE SECTION OR ARTICLE
This section/article is being written and is therefore not complete.
Thank you for your comprehension.

Display filters

Syntax:

tshark -R 'filter' -r capture.pcap

Some common filters:

  • http
  • http.request
  • http.response
  • dns
  • ip
  • ip.addr==192.168.1.0/24
  • ip.src
  • smtp.req.command contains "RCPT"

Keywords:

  • contains (ex: dns contains windows)

Online resources

Comments

blog comments powered by Disqus