tshark

Extract fields to columns Pull selected fields as a tabular header-prefixed table; pipe to awk/csv tooling tshark -r cap.pcap -Y http.request -T fields -e ip.src -e http.host -e http.request.uri -E header=y #tshark#observability#debug#network Follow a TCP stream as ascii Reassemble stream index 0 into readable ascii; prefer tshark over wireshark on servers tshark -r cap.pcap -q -z follow,tcp,ascii,0 #tshark#debug#network#troubleshooting TCP conversation statistics Rank TCP conversations by bytes/packets to find top talkers in a capture tshark -r cap.pcap -q -z conv,tcp #tshark#performance#observability#network Live capture with I/O stat intervals Per-second retransmission counts to correlate packet loss with app latency spikes tshark -i any -q -z io,stat,1,'COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission' #tshark#performance#monitoring#troubleshooting