How to use the command 'tshark' (with examples)

Tshark is a command-line packet analysis tool that serves as the terminal interface version of Wireshark, which is widely used for network protocol analysis. Tshark captures and understands network traffic, and it comes with powerful filtering and color-coding features that make it ideal for diagnosing and troubleshooting network issues, analyzing protocol behavior, and ensuring the security of network communications. It is highly favored by network administrators, security analysts, and forensic investigators who need detailed insights into network traffic.

Use case 1: Monitoring everything on localhost

Code:

tshark

Motivation:
Monitoring all network activity on the local machine is crucial for administrators and developers who wish to understand the entire scope of traffic data passing through the network interfaces. This method provides a holistic view, capturing every packet without restrictions or filters, making it possible to diagnose unexpected network behavior or security issues in real-time.

Explanation:

• tshark: This command starts Tshark in its default mode, capturing every packet on every available network interface. With no additional parameters or filters applied, it continuously records network traffic until manually stopped.

Example Output:

Capturing on 'eth0'
    1 0.000000000 192.168.1.2 → 224.0.0.1 IGMPv2 46 Membership Report group 224.0.0.251
    2 0.299934354 192.168.1.5 → 192.168.1.255 NBNS 92 Name query NB WORKGROUP<00>

Use case 2: Capturing packets matching a specific capture filter

Code:

tshark -f 'udp port 53'

Motivation:
When network traffic requires inspection for specific protocols or ports, using capture filters becomes essential. For example, DNS traffic uses UDP port 53. Focusing only on DNS can reduce noise and increase efficiency by capturing only relevant traffic, which is useful in narrowing down analysis on suspected DNS-related issues or in forensic monitoring.

Explanation:

• -f 'udp port 53': This argument specifies a capture filter to limit the captured traffic to only those packets using UDP protocol on port 53. Capture filters are set at the point of data collection and impact what data is saved by Tshark.

Example Output:

Capturing on 'eth0'
    1 0.000000000 192.168.1.2 → 8.8.8.8 DNS 74 Standard query 0x1234 A example.com

Use case 3: Showing packets matching a specific output filter

Code:

tshark -Y 'http.request.method == "GET"'

Motivation:
Output filtering is used when the entire network data has already been captured, but analysis requires focusing on specific packet criteria, such as HTTP GET requests. This type of filtering is helpful for web traffic analysis, identifying security threats or understanding user behavior over HTTP protocol.

Explanation:

• -Y 'http.request.method == "GET"': This parameter filters the already captured packets based on HTTP method, displaying only packets where the HTTP request method is GET. Such post-capture filtering helps highlight specific transactions or operations within a broader dataset.

Example Output:

    1 0.000000000 192.168.1.2 → 93.184.216.34 HTTP 452 GET / HTTP/1.1 

Use case 4: Decoding a TCP port using a specific protocol (e.g. HTTP)

Code:

tshark -d tcp.port==8888,http

Motivation:
Sometimes, traffic on non-standard ports needs to be analyzed using protocols commonly associated with other ports (e.g., HTTP typically uses port 80). This use case allows you to specify how Tshark should interpret data on certain ports, which can be valuable for debugging or reverse engineering applications using unconventional configurations.

Explanation:

• -d tcp.port==8888,http: This option informs Tshark to decode traffic on TCP port 8888 using HTTP protocol. This decoding is applied post-capture and directs Tshark in how to interpret the captured data at these ports.

Example Output:

    1 0.000000000 192.168.1.2 → 192.168.1.100 HTTP 345 GET /test HTTP/1.1 

Use case 5: Specifying the format of captured output

Code:

tshark -T json

Motivation:
Output formats can be adjusted to meet specific needs in presentation or compatibility with other tools. JSON format is prominent for its readability and structured nature, supportive of integrations with various analysis scripts and tools. Utilizing JSON allows for standardized data exchanges and further processing in automated pipelines.

Explanation:

• -T json: This flag forces Tshark to output the captured data in JSON format. JSON is favored for its lightweight and easy-to-parse nature, making it ideal for programmatic consumption.

Example Output:

[
  {
    "_index": "pcap_file",
    "_type": "_doc",
    "_score": 1,
    "_source": {
      "layers": {
        "frame": {
          "frame.interface_id": "0",
          "frame.encap_type": "1"
        }
      }
    }
  }
]

Use case 6: Selecting specific fields to output

Code:

tshark -T fields -e http.request.method -e ip.src

Motivation:
When you require specific pieces of information rather than full packet details, selecting fields helps condense the dataset to only what is required. This feature is beneficial when measuring or aggregating specific metrics, such as the request types and source IP addresses during web browsing activities.

Explanation:

• -T fields: This option denotes that specific fields are outputted rather than full packets.
• -e http.request.method: Specifies the inclusion of HTTP request method field in the output.
• -e ip.src: Specifies the inclusion of source IP address field in the output. By listing these fields explicitly, Tshark outputs only relevant data fields.

Example Output:

GET 192.168.1.2
GET 192.168.1.5

Use case 7: Writing captured packets to a file

Code:

tshark -w path/to/file

Motivation:
Saving captured network packets allows for offline analysis, easier sharing, and reproducibility of tests. This is commonly used in forensic investigations and research settings, where post-capture analysis needs to be deferred for later or performed across different software environments.

Explanation:

• -w path/to/file: Specifies the file path where Tshark writes the captured packets. This file is generally in .pcap format, which is compatible with many network analysis tools.

Example Output:

(No immediate console output; packets are saved to the specified path in file format)

Use case 8: Analyzing packets from a file

Code:

tshark -r path/to/file.pcap

Motivation:
Once packets are captured and stored in a file, analyzing this data becomes critical to solve specific network issues or address security concerns. This method is crucial for examining historical data or previously gathered evidence as Tshark allows precise post-capture investigations without accessing live network traffic.

Explanation:

• -r path/to/file.pcap: Reads packet data from a specified .pcap file for analysis. The -r flag allows Tshark to process and display this stored data as though it was being captured live.

Example Output:

    1 0.000000000 192.168.1.2 → 8.8.8.8 DNS 64 Standard query 0x1234 A example.com
    2 1.432567893 192.168.1.5 → 192.168.1.1 TCP 74 56587 → 443 [SYN] Seq=0 Win=64240 Len=0 MSS=1460

Conclusion:

Using Tshark provides a powerful command-line interface for capturing and analyzing network packets. The diverse set of options allows administrators and network analysts to customize their monitoring and analysis according to their specific needs and scenarios—from capturing all traffic data on a local machine to isolating particular protocol actions for detailed inspection. These use cases demonstrate the versatility and utility of Tshark in various network troubleshooting and analysis contexts.