Tshark Packet Analyzer

Capture and analyze network traffic, extract credentials, and carve files using tshark.

Tool Status

• Tool installed: !command -v tshark > /dev/null 2>&1 && echo "YES -- $(tshark --version 2>/dev/null | head -1)" || echo "NO -- Install: brew install wireshark (macOS, includes tshark CLI) | apt install tshark (Debian/Ubuntu)"
• Wrapper scripts available: !test -f scripts/tshark/capture-http-credentials.sh && echo "YES -- use wrapper scripts for structured JSON output" || echo "NO -- using standalone mode with direct commands"

Mode: Wrapper Scripts Available

If wrapper scripts are available (shown as YES above), prefer these commands. They provide structured JSON output and educational context.

Credential Capture

• bash scripts/tshark/capture-http-credentials.sh <interface> -j -x -- Extract HTTP credentials from unencrypted traffic (POST data, Basic Auth, cookies)

DNS Analysis

• bash scripts/tshark/analyze-dns-queries.sh <interface> -j -x -- Monitor DNS query patterns to detect tunneling, zone transfers, anomalies