> For the complete documentation index, see [llms.txt](https://blog.rootkid.in/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://blog.rootkid.in/exam-prep-notes/junior-penetration-tester-ejptv2-notes/host-and-network-penetration-testing/network-based-attacks/tshark-and-filtering-basics.md).

# Tshark & Filtering Basics

## Tshark Overview

Tshark is a command-line tool used for network packet analysis. It helps you capture, inspect, and analyze network traffic in a readable format. Tshark can provide insights into network behavior, identify issues, and troubleshoot problems. By capturing and decoding packets, it allows you to see details like source and destination addresses, protocols used, and even application data. It's like a detective tool for understanding what's happening on a computer network.

## **Tshark Commands**

### **General Commands**

* **List available capture interfaces:**

  ```bash
  tshark -D
  ```
* **Capture packets on a specific interface (e.g., eth0):**

  ```bash
  tshark -i eth0
  ```
* **Read and analyze packets from a saved pcap file:**

  ```bash
  tshark -r <file_path.pcap>
  ```

### **Advanced Analysis**

* **Read packets from a pcap file and display protocol hierarchy statistics quietly:**

  ```bash
  tshark -r <file_path.pcap> -z io,phs -q
  ```
* **Read packets from a pcap file and filter based on a display filter:**

  ```bash
  tshark -r <file_path.pcap> -Y "http.request"
  ```
* **Read packets from a pcap file and filter for HTTP GET requests with timestamp, source IP, and full URI:**

  <pre class="language-bash" data-overflow="wrap"><code class="lang-bash">tshark -r &#x3C;file_path.pcap> -Y 'http.request.method==GET' -Tfields -e frame.time -e ip.src -e http.request.full_uri
  </code></pre>
* **Read packets from a pcap file and filter for HTTP requests containing the word "password":**

  ```bash
  tshark -r <file_path.pcap> -Y 'http contains password'
  ```

### **Capture Options**

* **Capture packets on a specific interface with a packet count limit:**

  ```bash
  tshark -i eth0 -c 100
  ```
* **Capture packets and save to a file in pcap format:**

  ```bash
  tshark -i wlan0 -w capture.pcap
  ```

### **Display Options**

* **Display packet details in real-time with human-readable output:**

  ```bash
  tshark -i enp0s25 -V
  ```
* **Print a summary of unique source and destination IP addresses from a pcap file:**

  ```bash
  tshark -r capture.pcap -T fields -e ip.src -e ip.dst | sort -u
  ```
* **Filter and display packets between a specific source and destination IP address:**

  ```bash
  tshark -r <file_path.pcap> -Y 'ip.src==<IP> && ip.dst==<IP>'
  ```

***

***

***

**`Hacker's Mantra:`**`I’m still a hacker. I get paid for it now. I never received any monetary gain from the hacking I did before. The main difference in what I do now compared to what I did then is that I now do it with authorization. - Kevin Mitnick`