Network Packet Captures: Analyzing with TShark

When something breaks on your network, instinct might lead you straight to ping or traceroute. Those tools are great starting points, but if you really want to understand what's happening at the packet level, you need a capture tool. TShark is the command-line version of Wireshark, and it is one of the most powerful packet analysis tools in any network engineer's toolkit.

This post covers the core TShark workflows you'll use regularly for troubleshooting. If you've never used TShark before, that's fine. By the end, you'll be capturing and filtering traffic with confidence.

What Is TShark?

tshark is the terminal-based front end for the Wireshark dissector engine. It can capture live traffic, read saved .pcap files, filter packets, and output results in multiple formats. Because it runs in the terminal, it's ideal for use on headless servers, remote SSH sessions, and automation scripts where a GUI isn't available.

Install it on Debian/Ubuntu systems with:

sudo apt install tshark

On RHEL/CentOS systems:

sudo dnf install wireshark-cli

Listing Available Interfaces

Before capturing anything, you need to know which interfaces are available. Run:

tshark -D

You'll see output similar to this:

1. eth0
2. lo (Loopback)
3. any
4. docker0

Use the interface name or its number in subsequent commands.

Starting a Basic Capture

To capture live traffic on eth0, run:

sudo tshark -i eth0

This will stream decoded packets to your terminal. Press Ctrl+C to stop. To limit the capture to a specific number of packets, use the -c flag:

sudo tshark -i eth0 -c 50

To save the capture to a file for later analysis:

sudo tshark -i eth0 -w /tmp/capture.pcap

Reading a Saved Capture File

Once you have a .pcap file, read it back with:

tshark -r /tmp/capture.pcap

This is useful when you've captured traffic on a remote server and transferred the file to your workstation for review.

Filtering Traffic

Unfiltered captures generate a lot of noise. TShark supports two filter types that you'll use constantly:

• Capture filters: Applied during capture using BPF syntax. These reduce what gets written to disk.
• Display filters: Applied when reading a capture file or streaming output. These use Wireshark's display filter syntax.

Capture only HTTPS traffic using a capture filter:

sudo tshark -i eth0 -f "tcp port 443"

Filter by IP address using a display filter when reading a file:

tshark -r /tmp/capture.pcap -Y "ip.addr == 192.168.1.100"

Show only DNS queries:

tshark -r /tmp/capture.pcap -Y "dns.flags.response == 0"

Combine filters for precision. For example, show HTTP GET requests from a specific host:

tshark -r /tmp/capture.pcap -Y "http.request.method == \"GET\" && ip.src == 10.0.0.5"

Extracting Specific Fields

For troubleshooting or feeding data into scripts, you often only need specific fields rather than the full packet decode. Use the -T fields option with -e to specify the fields you want:

tshark -r /tmp/capture.pcap -T fields -e frame.time -e ip.src -e ip.dst -e tcp.dstport

This produces clean, tab-separated output that is easy to parse with tools like awk, grep, or Python.

Practical Troubleshooting Example

Suppose users are reporting slow application response times. You suspect retransmissions. Use TShark to check for TCP retransmissions in a capture:

tshark -r /tmp/capture.pcap -Y "tcp.analysis.retransmission" -T fields -e frame.number -e ip.src -e ip.dst -e tcp.stream

If you see a large number of retransmissions, you now have packet-level evidence pointing toward congestion, packet loss, or a misbehaving host.

What's Next

TShark is a foundational skill that unlocks a deeper level of network visibility. Once you're comfortable with captures and display filters, the logical next step is automating your analysis. In an upcoming post, we'll look at how to use Python with the pyshark library to programmatically parse packet captures, so you can build scripts that detect anomalies and generate reports automatically.