← All cheat sheets

TSHARK

Plain-text reference · 4 KB. Read it, search it (Ctrl-F) or print it.

tshark is the command-line Wireshark. Ideal for headless capture, scripted
pcap analysis, and extracting fields for a SIEM. Display-filter syntax is
identical to Wireshark; capture filters use BPF.

INTERFACES & BASIC CAPTURE#

tshark -D                      list capture interfaces
tshark -i eth0                 capture on eth0 (Ctrl-C to stop)
tshark -i eth0 -c 100          capture 100 packets then stop
tshark -i eth0 -a duration:60  capture for 60 seconds
tshark -i eth0 -w out.pcapng   write to file (no decode to screen)
tshark -r capture.pcapng       read from a file

CAPTURE FILTERS (-f, BPF) vs DISPLAY FILTERS (-Y / -R)#

tshark -i eth0 -f "tcp port 443"       capture filter (while capturing)
tshark -r in.pcap -Y "http.request"    display filter (on read)
Use -f to limit what hits disk; use -Y to analyse an existing file.

READING / FILTERING#

tshark -r in.pcap -Y "ip.addr==10.0.0.5"
tshark -r in.pcap -Y "dns"
tshark -r in.pcap -Y "http.request.method==\"POST\""
tshark -r in.pcap -Y "tls.handshake.type==1"      ClientHello only

FIELD EXTRACTION (-T fields -e) -- the SOC workhorse#

# One field per column, tab-separated, with a header row:
tshark -r in.pcap -T fields -e frame.time -e ip.src -e ip.dst \
  -e tcp.dstport -E header=y -E separator=,

# Extract DNS queries (domain hunting)
tshark -r in.pcap -Y "dns.flags.response==0" \
  -T fields -e frame.time_epoch -e ip.src -e dns.qry.name

# Extract TLS SNI (which hostnames were contacted)
tshark -r in.pcap -Y "tls.handshake.extensions_server_name" \
  -T fields -e ip.dst -e tls.handshake.extensions_server_name | sort -u

# Extract HTTP host + URI
tshark -r in.pcap -Y "http.request" \
  -T fields -e http.host -e http.request.uri -e http.user_agent

-E options: header=y (print column names), separator=, (CSV),
quote=d (double-quote values), occurrence=f (first value only).

OUTPUT FORMATS (-T)#

-T text        default human-readable (also -V for full detail)
-T fields      selected fields (with -e, best for parsing)
-T json        JSON (full dissection; large)
-T ek          Elasticsearch bulk-import JSON
-T pdml        XML dissection
-T tabs        packet summary, tab-separated

tshark -r in.pcap -V            full protocol-tree detail per packet
tshark -r in.pcap -x            hex + ASCII dump

STATISTICS (-z) -- great for triage#

tshark -r in.pcap -q -z conv,tcp          TCP conversations (top talkers)
tshark -r in.pcap -q -z conv,ip           IP conversations
tshark -r in.pcap -q -z endpoints,ip      per-IP totals
tshark -r in.pcap -q -z io,phs            protocol hierarchy
tshark -r in.pcap -q -z http,tree         HTTP request/response stats
tshark -r in.pcap -q -z dns,tree          DNS stats
tshark -r in.pcap -q -z io,stat,60        bytes/packets per 60s interval
(-q suppresses per-packet output so only the stats print.)

RING BUFFERS (long-running capture without filling disk)#

# 10 files of 100 MB each, oldest overwritten (rolling capture)
tshark -i eth0 -b filesize:100000 -b files:10 -w /pcaps/roll.pcapng
# Roll every 3600 seconds (hourly files)
tshark -i eth0 -b duration:3600 -w /pcaps/hourly.pcapng
(filesize is in kB. -b files:N caps the ring to N files.)

FOLLOW A STREAM FROM CLI#

tshark -r in.pcap -q -z follow,tcp,ascii,3     follow TCP stream index 3
tshark -r in.pcap -q -z follow,http,ascii,0    follow an HTTP stream

EXPORT OBJECTS (carve transferred files)#

tshark -r in.pcap --export-objects http,/tmp/http_out
tshark -r in.pcap --export-objects smb,/tmp/smb_out
(supported: http, smb, tftp, imf, dicom)

NAME RESOLUTION#

-n              disable all name resolution (fast, avoids DNS lookups)
-N mnNtd        enable specific resolutions (m=MAC, N=concurrent DNS, etc.)
Use -n in triage to avoid tshark issuing its own DNS queries.

HANDY ONE-LINERS#

# Top 20 destination IPs by packet count
tshark -r in.pcap -T fields -e ip.dst | sort | uniq -c | sort -rn | head -20

# Unique SNI hostnames contacted
tshark -r in.pcap -Y "tls.handshake.type==1" \
  -T fields -e tls.handshake.extensions_server_name | sort -u

# Count packets matching a filter
tshark -r in.pcap -Y "tcp.flags.syn==1 && tcp.flags.ack==0" | wc -l

Defensive reference on CyberRamen. Offensive / red-team sheets live on OffensiveRamen.com.