Follow a TCP stream as ascii tshark

Reassemble stream index 0 into readable ascii; prefer tshark over wireshark on servers

tshark -r cap.pcap -q -z follow,tcp,ascii,0

#tshark #debug #network #troubleshooting

more tshark all 4 commands →

TCP conversation statistics tshark -r cap.pcap -q -z conv,tcp Live capture with I/O stat intervals tshark -i any -q -z io,stat,1,'COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission' Extract fields to columns tshark -r cap.pcap -Y http.request -T fields -e ip.src -e http.host -e http.request.uri -E header=y