Unix and Linux network configuration. Multiple network interfaces. Bridged NICs. High-availability network configurations.


Reviews of latest Unix and Linux software. Helpful tips for application support admins. Automating application support.


Disk partitioning, filesystems, directories, and files. Volume management, logical volumes, HA filesystems. Backups and disaster recovery.


Distributed server monitoring. Server performance and capacity planning. Monitoring applications, network status and user activity.

Commands & Shells

Cool Unix shell commands and options. Command-line tools and application. Things every Unix sysadmin needs to know.

Home » Featured, Networking

Practical TShark Capture Filters

Submitted by on June 12, 2015 – 9:30 am

The tshark is the command-line interface for Wireshark – a popular open-source network packet analyzer. A seemingly infinite variety of options make tshark an unlikely choice for casual use. Nevertheless, the power of CLI justifies the extra effort to learn at least some tshark options.

Here’s a list of (hopefully) useful examples for capturing and analyzing packet data. Most of these examples come in two formats: reading from capture file or capturing in real time with a timeout value.

First, you need to define the ${nic} and/or ${infile} variables, where the former is the network interface of interest and the latter is the name of the capture file.

And now the examples:


Print Friendly, PDF & Email

No Comment »

1 Pingbacks »

Leave a Reply

%d bloggers like this: