TCP conversation statistics tshark
Rank TCP conversations by bytes/packets to find top talkers in a capture
tshark -r cap.pcap -q -z conv,tcp
more tshark
all 4 commands →
Live capture with I/O stat intervals
tshark -i any -q -z io,stat,1,'COUNT(tcp.analysis.retransmission)tcp.analysis.retransmission'
Extract fields to columns
tshark -r cap.pcap -Y http.request -T fields -e ip.src -e http.host -e http.request.uri -E header=y
Follow a TCP stream as ascii
tshark -r cap.pcap -q -z follow,tcp,ascii,0