There are two ways: the first is to look up the display field reference. There are two types of filters, BPF filters and display filters. '06:36:05.109737000','10.2.3.5','192.168.0.3','IN s1/tmm1 : NTP Version 3, client'īreaking down that command line we have: Optionĭisplay filter to select what packets to showīut where does one find out the field name for the desired field? Wireshark and TShark share a powerful filter engine that helps remove the noise from a.

any (Pseudo-device that captures on all interfaces) 4. nflog (Linux netfilter log (NFLOG) interface) 3. '06:25:14.987845000','10.2.3.5','192.168.0.3','IN s1/tmm1 : NTP Version 3, client' The first command you should run is sudo tshark -D to get a list of the available network interfaces: sudo tshark -D 1. Such an example command line might look like: $ tshark.exe -r -2 -R 'ip.addr=10.2.3.5' -T fields -E separator=, -E quote=d -e frame.time -e ip.src -e ip.dst -e _ws.col.Info Just as you can configure what columns to display in the packet summary in Wireshark – you can tell TShark what fields to display from the command line. In this case the TShark tool is very useful.

Sometimes you want to process packet captures from the command line rather than from Wireshark’s GUI.

Tshark display filter