tshark commands

4 commands, each with a one-line explanation. Click a command to copy it, or its title for details.

Commands 4 shown

  • Extract fields to columns
    tshark -r cap.pcap -Y http.request -T fields -e ip.src -e http.host -e http.request.uri -E header=y

    Pull selected fields as a tabular header-prefixed table; pipe to awk/csv tooling

    observability · debug · network

  • Follow a TCP stream as ascii
    tshark -r cap.pcap -q -z follow,tcp,ascii,0

    Reassemble stream index 0 into readable ascii; prefer tshark over wireshark on servers

    debug · network · troubleshooting

  • TCP conversation statistics
    tshark -r cap.pcap -q -z conv,tcp

    Rank TCP conversations by bytes/packets to find top talkers in a capture

    performance · observability · network

  • Live capture with I/O stat intervals
    tshark -i any -q -z io,stat,1,'COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission'

    Per-second retransmission counts to correlate packet loss with app latency spikes

    performance · monitoring · troubleshooting