Analyzing network traffic with Tshark

Conclusions

The Tshark analyzer is a simple, command-line tool for monitoring and analyzing data streams. Tshark filters out individual protocols from the array of packages with just a few simple steps.

Tshark is easy to use and learn, and, like its GUI-based counterpart Wireshark, it works well on a small scale. However, sooner or later, Tshark will impair system performance if you need to collect large volumes of data. See the Wireshark wiki [14] for some tips on mitigating any performance slumps that occur when you are using Wireshark or Tshark.

Infos

  1. Tcpdump: http://www.tcpdump.org
  2. Wireshark: https://www.wireshark.org
  3. Tshark man page: https://www.wireshark.org/docs/man-pages/tshark.html
  4. Pcap man page: http://www.tcpdump.org/manpages/pcap.3pcap.html
  5. Netfilter: http://www.netfilter.org
  6. TCP handshake: http://en.wikipedia.org/wiki/Transmission_Control_Protocol
  7. Package filtering with Tshark: https://thesprawl.org/research/packet-filtering/
  8. Various filter methods: http://wiki.wireshark.org/CaptureFilters
  9. Samba troubleshooting with Tshark: https://wiki.samba.org/index.php/Capture_Packets
  10. Samba sniffing in the Wireshark documentation: http://wiki.wireshark.org/SMB
  11. WiFi sniffing: http://wiki.wireshark.org/CaptureSetup/WLAN
  12. Bluetooth sniffing: http://wiki.wireshark.org/CaptureSetup/Bluetooth
  13. Analyzing USB traffic: http://wiki.wireshark.org/CaptureSetup/USB
  14. Performance optimization: http://wiki.wireshark.org/Performance

The Author

Valentin Höbel works as a Cloud architect for the VoIP specialists NFON AG in Munich. When he is not playing table football in his spare time, you will find him investigating current open source technologies.

« Previous 1 2 3

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
Print Issues
Digital Issues
 
SUBSCRIPTIONS
Print Subs
Digisubs
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

  • Capture File Filtering with Wireshark

    Wireshark doesn’t just work in real time. If you save a history of network activity in a pcap file using a tool such as tcpdump, you can filter the data with Wireshark to search for evidence.

    more »
  • Security Lessons

    Building a network flight recorder with Wireshark.

    more »
  • Core Technologies

    Learn what's going on in your network, using Linux and its arsenal of packet capture tools.

    more »
  • FOSSPicks

    This month's FOSSPicks was nearly lost in a stream of AES-256 noise, as Graham struggled to get his encrypted Linux installation (using LUKS) to live alongside an encrypted macOS installation (using APFS).

    more »
  • Wireshark

    If you know your way around network protocols, you can get to the source of a problem quickly with Wireshark.

    more »
comments powered by Disqus
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters

Support Our Work

Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.

Learn More

News

Tag Cloud

Administration Community Events Hardware Linux Linux Pro Magazine Mobile Programming Security Software Ubuntu Web Development Windows free software open source