Wireshark & tshark: packet capture and analysis

Wireshark is the GUI protocol analyzer; tshark is the same engine from the command line, which is what you want over SSH or inside a script. Both understand the same display-filter syntax.

Wireshark

wireshark -i eth0                    # capture on a specific interface
wireshark -i eth0 -w capture.pcap    # capture and save
wireshark -r capture.pcap            # open a saved capture

Display filters (typed into the filter bar, or passed to tshark with -Y):

Filter	Shows
http	HTTP traffic
ip.addr == 192.168.1.1	Traffic to/from one IP
tcp.port == 443	Traffic on one TCP port

tshark

tshark -r capture.pcap -c 100                          # first 100 packets
tshark -r capture.pcap -q -z io,phs                     # protocol hierarchy statistics
tshark -r capture.pcap -Y "http.request"                # only HTTP GET/POST requests
tshark -r capture.pcap -Y "http" -T fields -e frame.time -e ip.src -e http.request.full_uri
tshark -r capture.pcap -Y "frame contains \"<string>\""  # search packet contents for a string
tshark -r capture.pcap -Y "ip.addr == <ip>"
tshark -r capture.pcap -Y "http.cookie contains \"sessionid\""   # check session IDs
tshark -r capture.pcap -Y "http.user_agent"

Wireless filters

tshark -r capture.pcap -Y "wlan"
tshark -r capture.pcap -Y "wlan.fc.type_subtype == 0x000c"   # deauthentication frames only
tshark -r capture.pcap -Y "eapol"                             # WPA handshake packets only
tshark -r capture.pcap -T fields -e wlan.ssid -e wlan.bssid

Capture vs display filters

Type	Flag	Applied
Capture filter	-f (e.g. -f "port 80")	While capturing, reduces noise
Display filter	-Y in tshark, filter bar in Wireshark	On an already-captured file

Related

• SMB relay attack: intercepting NTLM traffic on the wire
• Host discovery & network mapping workflow: where packet-level visibility helps during recon
• Nmap: active scanning to compare against what you captured