TShark
Wireshark’s power in a terminal.
KaliParrotLinuxpassive
pkg: tshark
TShark is Wireshark’s CLI sibling, combining deep dissection with scriptable field extraction and filters.
Syntax
tshark -i {iface} -Y "{display filter}" -T fields -e {field}
Example
tshark -i eth0 -Y "http.request" -T fields -e http.host
Prints the Host header of every HTTP request seen on eth0.
Options & flags
What each switch does. Toggle them in the builder below to assemble a command.
Command builder
Tick options (and fill any values) to build a ready-to-copy command.
tshark
Usage examples
tshark -i eth0 -Y http.request -T fields -e http.host
Print the Host of each HTTP request.
tshark -r cap.pcap -Y "dns"
Show DNS traffic from a capture.
Advantages
- Full Wireshark dissection on CLI
- Great for field extraction/automation
- pcap in/out
Disadvantages
- Verbose syntax
- Heavier than tcpdump
- Needs privileges
Tags
#pcap#cli#analysis
Official docs: TShark ↗
Related commands
Frequently asked questions
What is TShark used for?
TShark is Wireshark’s CLI sibling, combining deep dissection with scriptable field extraction and filters.
What is an example TShark command?
A common example is: tshark -i eth0 -Y "http.request" -T fields -e http.host — Prints the Host header of every HTTP request seen on eth0.
Is TShark part of Kali Linux?
Yes. TShark ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install tshark.
What category of security tool is TShark?
TShark is a Sniffing & Spoofing tool with a passive-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.