c = number of packets after which capture has to sudo tshark -f 'tcp port 80' -F pcap -w /var/tmp/port_80_cap.pcap -c 10 w = name of the file where capture should be written to This is where Tshark comes in very handy, Tshark offers all the options that Wireshark has at a CLI level without the need for GUI applications as such, let’s see a typical example where we capture traffic on Port 80Ĭapturing something is really easy -f = filter While not every time you need a GUI tool or most importantly you don’t have access to a GUI environment, eg: you are running an EC2 cloud instance of ubuntu, typically you would not install a GUI extension to this, it is meant to run server workloads. Basically, if you never used Wireshark before it’s a sophisticated and popular GUI tool for doing packet captures and analysis. Wireshark is famous for packet capture and analysis of various packet-capture files. Sudo tshark -r capture_ospf.cap -Y 'frame.number = 4' -V Sudo tshark -r capture_ospf.cap -Y 'frame.number = 4' Sudo tshark -r /var/tmp/port_80_cap.pcap -Tfields -Y Sudo tshark -r /var/tmp/port_80_cap.pcap -Tfields -e ip.src -e tcp.port -e ip.ttl -e ip.dst

Sudo tshark -f 'tcp port 80' -F pcap -w /var/tmp/port_80_cap.pcap -c 10 If you wish for a quick reference instead of going through the post

Tshark port filter