Network Utility

Your Public IP: Loading...

Tshark Reference Cheatsheet

Basic Capture Commands

• Capture on a specific interface:
  tshark -i wlan0
• Capture only a limited number of packets:
  tshark -i wlan0 -c 100
• Capture packets without resolving hostnames (disable DNS resolution):
  tshark -i wlan0 -n

Filtering Traffic

• Capture only ARP requests:
  tshark -i wlan0 -Y "arp.opcode == 1"
• Capture only ICMP (Ping) traffic:
  tshark -i wlan0 -Y "icmp"
• Capture only DNS queries:
  tshark -i wlan0 -Y "dns.flags.response == 0"
• Capture only HTTP requests:
  tshark -i wlan0 -Y "http.request"

Capturing Specific Protocols

• Capture only TCP traffic:
  tshark -i wlan0 -f "tcp"
• Capture only UDP traffic:
  tshark -i wlan0 -f "udp"
• Capture only traffic to/from a specific IP:
  tshark -i wlan0 -f "host 192.168.1.100"
• Capture packets from a specific port (e.g., SSH on port 22):
  tshark -i wlan0 -f "port 22"

Extracting Specific Data

• Show only source and destination IPs and ports:
  tshark -i wlan0 -T fields -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport
• Extract HTTP hostnames from packets:
  tshark -i wlan0 -Y "http.host" -T fields -e http.host
• Show only MAC addresses in ARP requests:
  tshark -i wlan0 -Y "arp.opcode == 1" -T fields -e arp.src.hw_mac -e arp.dst.hw_mac

Reading from a PCAP File

• Read and analyze a previously captured file:
  tshark -r capture.pcap
• Apply a display filter to a PCAP file:
  tshark -r capture.pcap -Y "http"
• Extract only the source and destination IPs from a PCAP file:
  tshark -r capture.pcap -T fields -e ip.src -e ip.dst

This cheatsheet provides essential Tshark commands for efficient packet capturing and filtering while minimizing unnecessary traffic. Use it as a quick reference to enhance your network analysis workflow.