Command Line Tools

Wireshark includes powerful command-line utilities: tshark for capture and analysis, dumpcap for lightweight capture, and editcap for manipulating capture files.

Info

Command-line tools are essential for automation, remote capture on headless servers, and processing very large capture files where GUI performance would suffer.

tshark — The CLI Wireshark

tshark is the terminal version of Wireshark. It supports the same display filters, dissectors, and output formats.

Flag	Description
-i <iface>	Capture on specified interface
-f <filter>	Capture filter (BPF syntax)
-Y <filter>	Display filter after capture
-w <file>	Write packets to file
-r <file>	Read packets from file
-c <count>	Stop after N packets
-a duration:<sec>	Stop after N seconds
-T fields	Output specified fields (use -e)
-e <field>	Field to print with -T fields
-t <fmt>	Time format (a=absolute, r=relative, d=delta)
-q	Quiet mode (less output)
-V	Verbose protocol tree
-x	Print packet hex dump
-l	Line-buffered output

tshark Examples

1# Capture on eth0, write to file
2tshark -i eth0 -w capture.pcap
3 
4# Read file, apply display filter, show packet list
5tshark -r capture.pcap -Y "http.request.method == "GET""
6 
7# Extract specific fields as CSV
8tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port -E header=y -E separator=,
9 
10# Capture 100 packets and stop
11tshark -i eth0 -c 100 -w test.pcap
12 
13# Capture for 60 seconds
14tshark -i eth0 -a duration:60 -w timed.pcap
15 
16# Show protocol tree for a single packet
17tshark -r capture.pcap -V -c 1
18 
19# Real-time DNS monitoring
20tshark -i eth0 -f "udp port 53" -l

dumpcap — Lightweight Capture

dumpcap is a minimal capture tool without dissection capabilities. It is faster and uses less memory than tshark, making it ideal for long-running captures.

Flag	Description
-i <iface>	Interface to capture on
-f <filter>	Capture filter
-w <file>	Output file
-b <opt>	Ring buffer (multiple files)
-a <opt>	Stop condition (filesize, duration, packets)
-B <size>	Buffer size (in MB)
-p	Don't capture in promiscuous mode
-s <snaplen>	Snapshot length (bytes per packet)

dumpcap Examples

1# Continuous capture with ring buffer (10 files, 100MB each)
2dumpcap -i eth0 -b filesize:100000 -b files:10 -w /var/cap/ring.pcap
3 
4# Capture only first 100 bytes of each packet (snaplen)
5dumpcap -i eth0 -s 100 -w small.pcap
6 
7# Stop after 1GB
8dumpcap -i eth0 -a filesize:1000000 -w big.pcap
9 
10# List available interfaces
11dumpcap -D

editcap — File Manipulation

editcap manipulates pcap and pcapng files: split, merge, time-shift, deduplicate, and convert formats.

Flag	Description
-r	Reverse selection (keep instead of delete)
-A <time>	Start time for packet selection
-B <time>	End time for packet selection
-c <count>	Split file every N packets
-i <sec>	Split file every N seconds
-F <fmt>	Output format (pcap, pcapng, etc.)
-t <time>	Adjust timestamps by offset
-E <err>	Inject errors (for testing)
-d <dup>	Remove duplicate packets within window

editcap Examples

1# Remove first 1000 packets from a file
2editcap capture.pcap trimmed.pcap 1-1000
3 
4# Keep only packets 100-200
5editcap -r capture.pcap subset.pcap 100-200
6 
7# Split by time (1 hour per file)
8editcap -i 3600 capture.pcap hourly.pcap
9 
10# Remove duplicates within 5-second window
11editcap -d capture.pcap dedup.pcap
12 
13# Convert pcapng to classic pcap
14editcap -F pcap capture.pcapng capture.pcap
15 
16# Adjust timestamps by +2 hours
17editcap -t 7200 capture.pcap shifted.pcap

mergecap — Combine Files

mergecap combines multiple capture files into one, sorting packets by timestamp.

mergecap

1# Merge all pcap files in directory
2mergecap -w combined.pcap *.pcap
3 
4# Merge specific files with verbose output
5mergecap -v -w out.pcap file1.pcap file2.pcap file3.pcap
6 
7# Merge without sorting (faster, preserves original order)
8mergecap -a -w unsorted.pcap *.pcap

Performance Tip

For 24/7 production capture, use dumpcap with ring buffers. Then use tshark or editcap for post-processing. This pattern minimizes dropped packets and disk usage.

Next: Capture Filters Back to Wireshark