Capture filtersĬapture filters are filters that are used when capturing data. Tshark provides two types of filters, capture filters and display filters.

Filters can be based on a variety of criteria, including source or destination IP address, protocol, port number, and more. tabs -The human-readable one-line summary is delimited by an ASCII horizontal tab character, just like the text report.įor capturing and analyzing network traffic, tshark provides a number of filter options.text - human readable text one-line summary of each packet.

ek - an EK JSON-based format for the bulk insert into elastic search cluster.

jsonraw - a JSON-based machine parsing format with only raw hex decoded fields (same as -T json -x but without text decoding, only raw fields included).

This data corresponds to the packet information printed with the -V flag.

json - Packet Summary, a JSON-based format for a decoded packet's details summary information.This information is the same as the one-line summary that is printed by default. psml - Packet Summary Markup Language, an XML-based format for decoded packet summary information.ps - PostScript for a human-readable one-line summary of each packet, or a multi-line view of each packet's details, depending on whether the -V flag was specified.This data corresponds to the packet details printed with the -V flag. pdml - Packet Details Markup Language, an XML-based format for decoded packet data.fields - The values of the fields specified by the -e option in the format specified by the -E option.Here is a list of formats you can use with tshark command: To capture network traffic with tshark, run the command with the -i option followed by the name of the capture interface you want to use.įor example, to capture traffic on the wireless interface, use: tshark -i wlan0 Red Hat/CentOS Stream sudo yum install wireshark-cliĪrch Linux sudo pacman -S wireshark-cli Capturing network traffic with tshark When compared to tcpdump, tshark has some more filter options to narrow down the results. It extracts data from packets and outputs it in a variety of formats, including plain text, CSV, JSON, and XML. One of the key advantages of Tshark is the ability to filter packets based on different criteria. It is a part of the Wireshark package and uses the same packet capture library as Wireshark. Tshark is a command-line network traffic capture and analysis tool.

Wireshark cli