HackBlue

Tools · Network tools · 07 / 24

tshark: read a capture without opening a GUI

tshark is Wireshark's terminal reader. Point -r at the lab pcap, keep the first pass short with -c, and add -2 only when the field you need depends on a later frame.

14 min read · practice only with authorization

Reading is the default job

tshark -r /lab/evidence.pcap prints a one-line summary per frame, the same family of summary Wireshark shows in the packet list. You stay in the terminal, you can pipe the lines, and you do not click through a file that may contain lab secrets. -c 20 stops after twenty frames so the first look is a sample, not a transcript.

This lesson set does not cover the Wireshark window. The questions here are ones a display filter and a column can answer from a file you already have. Capturing with tshark uses -i and a BPF -f expression, under the same scope rules as tcpdump. Once the pcap exists, you filter with -Y.

One pass or two

Some columns need a later frame: which response belongs to this request, or a retransmission mark that depends on seeing the original. -2 makes tshark read the file twice so those fields can fill in. The manual is specific: -2 has to seek backward, so it works on a real file and not on a pipe or a live capture.

Start without -2. Add it when a field you asked for stays empty and the manual says that field needs future knowledge. A huge lab file read twice is slower. That is a reason to slice with a filter, not a reason to skip the second pass when the column is the whole question.

  • -r names the pcap or pcapng.
  • -c limits how many frames print.
  • -q suppresses the packet list when you only want a -z statistic.
  • -2 is for analysis fields that look ahead. Skip it for a plain summary.

A worked defensive case

The case folder already holds /lab/evidence.pcap from the files-VM ticket. You print three summary lines to confirm the file opens and the clock matches the ticket. The summaries show 10.8.0.20 and 10.8.0.40 on port 443, which agrees with the tcpdump filter written next to the filename.

You stop there. The summary does not yet say which name the client asked for. That is the next command, a field extraction, not a second capture and not a GUI session on a shared jump host.

Where this is documented

tshark(1) documents -r, -c, -q, and -2. The same manual's description of display filters is the -Y section. Wireshark's packet-list columns and tshark's default summary are the same dissection.

Use a host-only lab network, or a capture the owner already handed you. These commands read that file or record a single lab host. They are not a scan of the public internet.

Commands

Open the lab file and print three summary lines
tshark -r /lab/evidence.pcap -c 3
Two-pass read, only frames marked as retransmissions
tshark -r /lab/evidence.pcap -2 -Y 'tcp.analysis.retransmission' -T fields -E header=y -e frame.number -e ip.src -e ip.dst -e tcp.stream

Diagram

From a sealed pcap to a short, checkable summary

  1. File

    The case folder already has the pcap. -r reads it.

  2. Sample

    -c keeps the first printout to a handful of lines.

  3. Clock

    You compare those lines with the timestamp in the ticket.

  4. Stop

    A missing column is a later -T fields command, not a new capture.

Check yourself

1. The pcap is already in the case folder. Which flag reads it?

2. You add -2 and pipe a live interface into tshark. What does the manual say happens?

3. You want to confirm the file matches the ticket before you extract columns. What do you print first?