Wireshark / tshark

Packet capture and protocol analysis for wired and 802.11 wireless traffic.

Quick Start (tshark CLI)

tshark -i eth0 -w capture.pcap
tshark -r capture.pcap -Y "http" -T fields -e http.host -e http.request.uri
tshark -r capture.pcap -Y "ntlmssp" -T fields -e ip.src -e ntlmssp.auth.username

# Wireless examples
tshark -r wifi.pcap -Y "wlan.fc.type_subtype == 0x08" -T fields -e wlan.bssid -e wlan.ssid
tshark -r wifi.pcap -Y "eapol"
tshark -r wifi.pcap -Y "tls.handshake.certificate"

Key Display Filters