>

Analyze Captures With tshark

Read pcap files and print packet summaries or field values.

LinuxnetworkmonitoringtcpdumpLow risk
Run tshark -r capture.pcap to decode and list the packets in a capture file.

01Command

Command
$ tshark -r capture.pcap

02What it does

tshark applies Wireshark's dissectors without a GUI, so you can filter with -Y, select fields with -T fields -e and write statistics with -z. It is scriptable and works over SSH on servers.

03Risk

RiskLow risk
Requirementssudo apt install tshark
!Warning: Live capture needs elevated privileges; captures often contain sensitive payloads, so store and share them carefully.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

  • Debian package: tshark
    Debian · vendor-doc · 2026-09-20
    Evidence: Debian packages tshark, the command-line version of Wireshark, which dissects capture files.
  • Wireshark / tshark
    Official project · vendor-doc · 2026-09-20
    Evidence: Debian packages tshark, the command-line version of Wireshark, which dissects capture files.

Last verified: 2026-09-22 · Category: Network

06Related solutions

Check RAM Usage with free -h
Linuxmonitoringmemoryfree

Use free -h to see used, free, and available memory plus swap in GB/MiB instead of raw kilobytes.

Low risk ✓ 2026-09-17
Show IP addresses in a compact table with `ip -br a`
Linuxifconfignetworktroubleshooting

One command that prints every interface with its state and IPv4/IPv6 addresses in a short table — the modern, memorable replacement for digging through `ifconfig` or the verbose `ip addr` output.

Low risk ✓ 2026-09-17
Trace the route to a host with `traceroute`
Linuxroutingnetworktraceroute

The classic forgotten-syntax command: `traceroute` shows every router between you and a destination plus the round-trip time of probes to each hop.

Low risk ✓ 2026-09-17