Wireshark Cheatsheet
tshark CLI
Use this Wireshark reference while you build software engineering projects, review code, or refresh the syntax you reach for most.
Core Flags
tshark is the same dissection engine as the GUI with a terminal front end. It
reads a file with -r or captures live with -i.
| Flag | Meaning |
|---|---|
-i <iface> | Capture interface, name or index. Repeat for several |
-D | List interfaces and exit |
-r <file> | Read a capture file, - for stdin |
-w <file> | Write pcapng, - for stdout. .gz compresses |
-f "<bpf>" | Capture filter, BPF, kernel-level |
-Y "<dfilter>" | Display filter, Wireshark syntax |
-R "<dfilter>" | Read filter, needs -2 |
-2 | Two-pass analysis, needed for anything that depends on later packets |
-c <n> | Stop after n packets |
-a duration:<s> | Stop after n seconds. Also filesize:, files:, packets: |
-s <n> | Snaplen in bytes |
-p | No promiscuous mode |
-n | No name resolution at all |
-N <mtdnsNvg> | Enable specific resolutions, e.g. -N n for network names |
-V | Full packet detail tree |
-O <protos> | Detail for these protocols only |
-x | Hex and ASCII dump |
-T <format> | text, fields, json, jsonraw, pdml, psml, ek, tabs |
-e <field> | Field to print with -T fields, repeatable |
-t <format> | Timestamp format, see below |
-d <sel>,<proto> | Decode As, e.g. -d tcp.port==8888,http |
-z <stat> | A statistic, usually with -q |
-q | Suppress the packet list, print only stats |
-Q | Only true errors to stderr, quieter still |
-l | Flush stdout after each packet, for piping live |
-o <pref>:<val> | Override any preference |
-C <profile> | Use a named configuration profile |
-b <opt> | Ring buffer, duration:, filesize:, files:, packets: |
-P | Print the summary even while writing with -w |
-G <report> | Dump a reference table, -G help lists them |
Time formats for -t: r relative to the first packet (default), a absolute
time of day, ad absolute with date, d delta from the previous packet, dd
delta from the previous displayed packet, e epoch, u/ud the UTC forms. Add
.N for sub-second digits, so -t ad.6 is microseconds with a date.
Field Extraction
-T fields with -e is the reason to use tshark at all. It turns a capture into
columns you can pipe into awk, sort, or a spreadsheet.
# Tab-separated by default tshark -r cap.pcapng -T fields \ -e frame.number -e ip.src -e ip.dst -e tcp.dstport -e _ws.col.info # CSV with a header row tshark -r cap.pcapng -T fields -E header=y -E separator=, -E quote=d \ -e frame.time_epoch -e ip.src -e http.host -e http.request.uri \ -Y http.request # Only the last occurrence of a repeated field tshark -r cap.pcapng -T fields -E occurrence=l -e ip.addr # Aggregate repeated fields with a comma instead of a tab tshark -r cap.pcapng -T fields -E aggregator=, -e dns.a -Y "dns.count.answers > 1"
-E options: header=y|n, separator=/t|/s|<char>, quote=d|s|n,
occurrence=f|l|a (first, last, all), aggregator=,|/s|<char>, bom=y|n.
JSON output when you want structure rather than columns:
tshark -r cap.pcapng -T json -Y "dns" | jq '.[]._source.layers.dns' tshark -r cap.pcapng -T json -J "http tcp" # only these trees, expanded tshark -r cap.pcapng -T ek -Y http > http.ndjson # Elasticsearch bulk format tshark -r cap.pcapng -T pdml -Y http > http.xml # XML, one packet per element
One-Liners
# Top talkers by bytes tshark -r cap.pcapng -q -z conv,ip # Every hostname requested, with counts tshark -r cap.pcapng -T fields -e http.host -Y http.request \ | sort | uniq -c | sort -rn # Every TLS SNI, deduplicated. Works without decryption tshark -r cap.pcapng -T fields -e tls.handshake.extensions_server_name \ -Y "tls.handshake.type == 1" | sort -u # DNS queries and the answers they got tshark -r cap.pcapng -T fields -e dns.qry.name -e dns.a \ -Y "dns.flags.response == 1" # Slowest HTTP responses tshark -r cap.pcapng -T fields -e http.time -e http.request.uri \ -Y "http.response" | sort -rn | head -20 # Retransmissions per stream tshark -r cap.pcapng -T fields -e tcp.stream \ -Y tcp.analysis.retransmission | sort -n | uniq -c | sort -rn # Who sent resets tshark -r cap.pcapng -T fields -e ip.src -e tcp.srcport \ -Y "tcp.flags.reset == 1" | sort | uniq -c | sort -rn # Unique MAC to IP pairs, an ARP inventory of the segment tshark -r cap.pcapng -T fields -e arp.src.hw_mac -e arp.src.proto_ipv4 \ -Y "arp.opcode == 1" | sort -u # Bandwidth per second tshark -r cap.pcapng -q -z io,stat,1 # Carve out one conversation into a small file to share tshark -r cap.pcapng -Y "tcp.stream == 12" -w stream12.pcapng # Live tail of DNS queries, flushed per packet sudo tshark -i en0 -l -f "port 53" -T fields -e frame.time -e dns.qry.name
Live Capture Headless
On a server, capture with dumpcap and analyze later. dumpcap is a small
setuid-capable helper that does nothing but write packets, so it drops fewer
packets than tshark and is a much smaller attack surface.
# Bounded ring, 20 files of 100 MB, oldest overwritten sudo dumpcap -i eth0 -B 64 -w /var/log/net.pcapng \ -b filesize:100000 -b files:20 # Rotate hourly, keep 24 hours sudo dumpcap -i eth0 -w /var/log/net.pcapng -b duration:3600 -b files:24 # Ten seconds of one host, then exit sudo dumpcap -i eth0 -f "host 10.0.0.5" -a duration:10 -w /tmp/host.pcapng # Stream a remote capture into the local GUI ssh root@host 'tcpdump -i eth0 -U -s0 -w - "not port 22"' | wireshark -k -i -
Rules for a capture that will run unattended:
- Always bound it. -b filesize: plus -b files: or an -a stop condition.
An unbounded capture fills the disk.
- Always exclude your own management session, -f "not port 22", or the
capture records itself recording.
- Raise the buffer with -B 64 or more. Drops show up as phantom
retransmissions later.
- Use pcapng so multiple interfaces and nanosecond timestamps survive.
- Keep the snaplen full unless disk is the constraint. -s 96 gives headers
only and makes reassembly and Follow Stream useless.
Companion Tools
| Tool | Does |
|---|---|
dumpcap | Capture only. Fastest and safest writer |
capinfos | File metadata, counts, rates, hashes, drop counts |
editcap | Cut, split, dedupe, convert, truncate, inject secrets |
mergecap | Merge files in timestamp order |
reordercap | Sort a file by timestamp |
text2pcap | Build a pcap from a hex dump |
randpkt | Generate random packets, for fuzzing a dissector |
sharkd | JSON-RPC dissection daemon, for building tools on the engine |
# Drop duplicate packets within a 5-packet window, or by time editcap -d cap.pcapng dedup.pcapng editcap -D 100 cap.pcapng dedup.pcapng editcap --novlan cap.pcapng untagged.pcapng # Convert to classic pcap for an old tool editcap -F pcap cap.pcapng cap.pcap # List every field name a protocol defines tshark -G fields | awk -F'\t' '$3 ~ /^quic\./ {print $3"\t"$2}' # List protocols, decode-as tables, or the full preference set tshark -G protocols | head tshark -G decodes | head tshark -G currentprefs | grep -i "^#tcp\."