Reading a file uses the -r option of Tshark. Suppose there is a captured file example.pcap The command-line tool provides console-based functionality to analyze a captured file.

pcap file and shows the full packet in text and value format. pcap file is the output file when captured with the Tshark command. #tshark -i eth12 -i eth13įor capturing over all network interfaces. #tshark -i eth12įor capturing on multiple interfaces. The first step is to select the interfaces, where the relevant packets are available.įor catapulting on an interface, you can give a numeric value or name. The more accurate the capture, the easier, and fast the analysis will be. The next step is to do an analysis of the captured file. Mostly when needs to verify protocol behavior. Capture is to analyze a network message flow. Now we have a list of network interfaces to capture the computer network bytes. any (Pseudo-device that captures on all interfaces) nfqueue (Linux netfilter queue (NFQUEUE) interface)ħ. nflog (Linux netfilter log (NFLOG) interface)ģ. To list down the interfaces available for capturing: #tshark -DĢ. usr/sbin/tshark The following are the Tshark examples.Ĭapturing is done on specific interfaces or all interfaces.

Tshark read pcap