PCAPNG (Packet CAPture Next Generation) is the file extension for the PCAP Next Generation dump file format. The PCAPNG file type is primarily associated with WireShark by Gerald Combs. You can’t just open the file using an editor like Vim. pcap extension is a special formatted file. # tshark -i eth0 -w /tmp/dump.pcap -c 100 For example the following command saves the output to a file named dump.pcap in “/tmp” directory. Use “-w “ option to tell TShark to dump the output to a file. You often need to save data to a file to use it later. You can limit the number of packets captured and displayed on the screen. If you want to set limit,” use “ -c “ (count) option. This command produces output continuously. “ -i ” option is used for setting which device we interested in. If you use old systems, try command: “ifconfig -a” You can see these devices with “ip addr show” command too. If you have multiple NICs, you must select which NIC wants to inspect. Network packets are processed via a network interface card (NIC) on servers. Tshark works like “tcpdump”, “ngrep”, and others, however, as it provides the protocol decoding features of Wireshark. Maybe you are the “terminal” lover and think the terminal output is more human-readable. You can analyze the Linux server directly on itself. You don’t have GUI (X Windows) or don’t use it. If you are logged in as a regular, non-root user, you need sudo rights to use the TShark utility and need adding “sudo” prefix to all commands. In Debian or Ubuntu or derivatives, you can install with the following command: # apt-get install tsharkĬheck the installation with the following command: # tshark -v In RHEL machines you can install with the following command: # yum install wireshark So A Linux Shell and Wireshark lover should prefer using TShark. However, if you a Wireshark lover, you can use Wireshark in the shell. Tcpdump is a powerful command-line tool that helps ease the pain of troubleshooting network issues. If you’ve ever dived deep into the Linux world, you’ve heard of Tcpdump or used it. If you are a system engineer, you have to work in black screens named as the shell or maybe you don’t like graphic interfaces like me. But Wireshark requires a graphic user interface (GUI). When we talk about network sniffing, Wireshark is the first thing that comes to mind. Whatever you are a DevOps engineer or system administrator or Linux administrator and even software engineer, you need to analyze network packets.

Wireshark command line tools exercise