Tshark

Tshark is the terminal-based network protocol analyzer that accompanies the Wireshark project. It provides the same dissectors and analytic capabilities as the GUI-based Wireshark but operates entirely from the command line. Tshark can capture live traffic from network interfaces or process packets from capture files such as pcap or pcapng.

Key features include support for capture filters to limit traffic at capture time and display filters to refine analysis after capture. It can perform one-pass or two-pass analysis (the -2 option enables two-pass analysis for protocols that benefit from post-processing). Tshark supports a variety of output formats and can export data for scripting and reporting.

Output options are configured with the -T flag, which can specify formats such as text, json, csv, pdml, or ps. The -e option selects specific fields when using -T fields, and -E controls field formatting. Display filters can be applied with -Y, while capture filters use -f. Other common options include -i to select an interface, -w to write to a capture file, -r to read from a file, -l to line-buffer stdout, and -n to disable name resolution.

Tshark is cross-platform, available on Windows, macOS, and Linux, and is distributed as part of the Wireshark suite under the GPL. It is widely used for automated network monitoring, scripting, forensic analysis, and environments where a lightweight, non-GUI tool is preferred.

Examples include: tshark -i eth0 -f "port 80" to capture with a BPF filter; tshark -r capture.pcap -Y "http.request" -T json to filter and output JSON; and tshark -i eth0 -f "tcp" -c 100 -T fields -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport for field-based extraction.