tshark Command-Line Packet Analysis Guide

2026年9月19日 LOG admin

Wireshark in a GUI is the right tool for a two-minute look and the wrong tool for a 20 GB capture on a jump host with no X server. tshark is the same dissection engine without the window: it can capture, filter, extract specific fields into CSV, produce conversation statistics and export transferred files, all over SSH. This guide covers the options that earn their place in an ops runbook.

Capture: the flags that matter

# Live capture with a capture filter (libpcap syntax - cheap, applied in kernel)
sudo tshark -i eth0 -f "tcp port 22 or icmp" -c 200

# Write to a file and show a running summary (-P)
sudo tshark -i eth0 -f "tcp port 443" -w /tmp/https.pcapng -P

# Ring buffer: rotate every 100 MB, keep 10 files
sudo tshark -i eth0 -b filesize:102400 -b files:10 -w /tmp/cap.pcapng

# Snapshot length for a smaller file when you only need headers
sudo tshark -i eth0 -s 128 -w /tmp/headers.pcapng

Capture filters (-f) are implemented by libpcap and are far more efficient than display filters for live traffic; display filters (-Y) can eliminate packets you already dropped, but on a busy interface they are the reason tshark cannot keep up.

Read and filter an existing capture

# Summary view (like tcpdump)
tshark -r capture.pcapng | head

# Display filter - Wireshark syntax, quote it in bash
tshark -r capture.pcapng -Y "tcp.flags.reset == 1"
tshark -r capture.pcapng -Y "ip.addr == 10.10.10.5 && tcp.port == 443"
tshark -r capture.pcapng -Y "dns.flags.rcode != 0"
tshark -r capture.pcapng -Y "tls.handshake.extensions_server_name contains example.com"
tshark -r capture.pcapng -Y "tcp.analysis.retransmission"

# Two-pass analysis: needed for filters that depend on both directions
tshark -2 -r capture.pcapng -R "tcp.stream == 7"

Two filter families are worth keeping in muscle memory: tcp.analysis.* (retransmission, fast retransmission, zero window, duplicate ACK) and tcp.stream (follow a single conversation after you have found it).

Extract fields instead of reading packets

# Fields to CSV - the fastest way to answer "what happened, in order"
tshark -r capture.pcapng -T fields \
  -e frame.time_relative -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport \
  -e tcp.flags.str -e tcp.analysis.retransmission \
  -E header=y -E separator=, -E quote=d > flows.csv

# HTTP requests without any body content
tshark -r capture.pcapng -Y "http.request" \
  -T fields -e frame.number -e http.host -e http.request.uri -e http.user_agent

# DNS queries and answers
tshark -r capture.pcapng -Y "dns.flags.response == 0" -T fields -e dns.qry.name | sort -u

Statistics that answer the top questions

# Who talked to whom, and how much
tshark -r capture.pcapng -q -z conv,tcp
tshark -r capture.pcapng -q -z conv,ip

# Expert information: the dissector's own diagnosis
tshark -r capture.pcapng -q -z expert

# Protocol hierarchy - what is actually in this capture
tshark -r capture.pcapng -q -z io,phs

# Top talkers by bytes
tshark -r capture.pcapng -q -z endpoints,ip

# Time-bucketed throughput (good for spotting microbursts)
tshark -r capture.pcapng -q -z io,stat,1,"ip.addr==10.0.0.5"

-z expert plus -z conv,tcp resolves most "the application is slow" tickets: one shows the protocol-level warnings (retransmissions, window problems, malformed frames), the other shows whether one conversation dominates.

Export transferred objects

# Pull HTTP objects out of a capture
mkdir -p /tmp/objects
tshark -r capture.pcapng --export-objects http,/tmp/objects
ls -la /tmp/objects

# SMB and TFTP are also supported
tshark -r capture.pcapng --export-objects smb,/tmp/smb

This turns a capture into evidence: the actual file the client downloaded, without re-running the transfer.

Practical workflow on a server

Capture with a kernel-side filter and rotation — never let a capture fill the root filesystem.
Reduce the capture first with -Y and -w to a smaller file, then analyse the small file. Iterating on a 20 GB file is pure latency.
Use -z conv to find the suspicious conversation, then -Y "tcp.stream == N" to isolate it.
Extract fields to CSV and process with your usual tooling rather than reading packets by eye.
Keep the capture plus the analysis commands in the incident ticket — a filtered capture with the command line that produced it is reproducible evidence.

One habit worth building: run every capture through -z expert before you look at anything else. What the dissector flags in ten seconds usually beats what you find by scrolling in ten minutes.