TSHARK(1) TSHARK(1) (NAME) tshark - (SYNOPSIS) tshark [ -i |- ] [ -f ] [ -2 ] [ -r ] [ -w |- ] [ options ] [ ] tshark -h|--help tshark -v|--version (DESCRIPTION) TShark . . TShark pcapng Wireshark . TShark tcpdump . pcap . -r TShark tcpdump . TShark Wireshark . gzip Zstandard LZ4 . (DESCRIPTION) wireshark(1) Wireshark TShark . zlib ( ). zlib TShark . LZ4 ZStandard . TShark (preferences) ( Wireshark ) "frame number" ( ) . -V . -O (top-level) . "tshark -G protocols" . -P -V -O . pcap . . -f . pcap . TShark TShark . TShark . Wireshark -Y . . TShark . -f -Y ( ) . ( -r ) ( -r ) . -w TShark . -w . . TShark -w ( -w ). -w -P -w -V -O . -P -V -O . TShark pcapng . -F . -F . dumpcap(1) pcapng pcap. --compress --compress . --compress ( ) -w . TShark . -q . -Q . -q -Q -P -V -O . -q -Q -z . -G TShark ..SH " (OPTIONS)" -2 - (two-pass) . TShark 'response in frame #' . (reassembly) . (seek backwards) pipe FIFO . -a|--autostop TShark . test:value test : duration:value value . ( 0.5) . files:value value . filesize:value value . -b TShark . TShark ( ). 232 () . packets:value value . -c . -A : TShark rpcap:// . libpcap . -b|--ring-buffer TShark << >> (multiple files) . TShark . TShark . -w outfile_00001_20260714120117.pcap outfile_00002_20260714120523.pcap ... files << >> (ring buffer) . TShark . files ( ). key:value key : duration:value value . ( 0.5) . files:value value ( ). . : . files duration interval filesize . -b -b . filesize:value value . 232 () . interval:value value . 3600 . packets:value value . printname:filename filename . filename stdout - stderr . nametimenum:value . value ( log_00001_20260714164426.pcap). value ( log_20210828164426_00001.pcap). . : tshark -b filesize:1000 -b files:5 . -B|--buffer-size ( MiB 2 MiB ). . (drop) . TShark 2 MiB . UNIX Linux macOS \*BSD Solaris AIX libpcap 1.0.0 Windows . UNIX libpcap . . -i . -i -i . . -c . . -a packets: . -C . --global-profile . ( UN*X '/usr/share/wireshark/profiles' Windows profiles Wireshark C:\Program Files\Wireshark\profiles. macOS (app bundle) Contents/Resources/share/wireshark/profiles .) . -D|--list-interfaces TShark . . -i . Windows GUID . -e -T ek|fields|json|pdml . . -T fields . "_ws.col." . at (@) . : tshark -T fields -e frame.number -e ip.addr -e udp -e _ws.col.info (tab) . -E . ( ) . ( "Hypertext Transfer Protocol") ("http") . -E -T fields . : bom=y|n y UTF-8 ( ef, bb, bf) . n . header=y|n y -e . n . separator=/t|/s| . /t ( ) /s . . occurrence=f|l|a . f l a ( ). aggregator=,|/s| . , ( ) /s . . quote=d|s|n . d (double-quotes) s (single-quotes) n () . (escaped). escape=y|n y ( ) (backspace) C "\n" . n . y . escape_formulas=y|n y CSV . = + - @ ( ) . . n . split= . ( Diameter SCTP ). ( ) . CSV -T fields . . -f . . -i . -i -i . . Capture->Capture Filters "predef:" . : tshark -f "predef:MyPredefinedHostOnlyFilter" -F -w . -w -F . -F . pcapng ( ). . -g () (group-read) ( () ). -G -G TShark (glossary) (dump) . fields . -C . help . : column-formats TShark . . . ( "%rD") ( "Dest port (resolved)") ( "_ws.col.res_dst_port") gui.column.format -o . currentprefs stdout . decodes << >>/<< >> stdout . . . "tcp.port" << >> "http" defaultprefs stdout . . dissectors stdout . . . dissector-tables stdout . . . "tcp.port" (GUI) ( ftenum "heuristic") ( ) << >> ( ) elastic-mapping[,filter] ElasticSearch stdout . () . filter ( Kibana) : tshark -G elastic-mapping,ip,udp,dns enterprises (PEN) IANA . fieldcount stdout . fields[,prefix] stdout . HTML . . . . (Protocols) 'P' (Header Fields) 'F' ( ftenum) ( ) " " FT_BOOLEAN : : : 0x.... fields . (Search Output) folders TShark . About | Folders . . . ( "Personal configuration:") ( "/home/vagrant/.config/wireshark/") ftypes "ftypes" ( fundamental types) TShark . . . FTYPE ( "FT_IPv6") ( "IPv6 address") heuristic-decodes (heuristic decodes) . . . ( "tcp") ( "ucp") ( "T" "F") ( "T" "F") ( "ucp_tcp") ( "UCP over TCP") help . manuf MAC manuf . plugins . . . / Lua/ extcap ( "gryphon.so") ( 0.0.4) ("dissector", "tap", "file type", ) profiles[,filter] . "global" "personal" "all" . "all" . ( ) protocols stdout . HTML . . . ( "T" "F") ( "T" "F") ( "T" "F") services () TCP UDP SCTP . values value_strings range_strings / (true/false) . . . : (Value String) (Range String) / (True/False String). 'V' 'R' 'T' . (Value Strings) 'V' (Range Strings) 'R' : : / (True/False Strings) 'T' / (True String) (False String) -h|--help . -H "hosts" . -W n . . "hosts" . . -i|--interface | - (pipe) . "tshark -D" ( ) "tshark -D" . TShark loopback loopback loopback . TShark . FIFO ( ) "-" . Windows "\\.\pipe\pipename" . pcapng pcap . pcapng (endianness) . . pcapng . -I|--monitor-mode << >> (monitor mode) Wi-Fi IEEE 802.11 . . . . -i . -i -i . -j ek|json|jsonraw|pdml . . . : tshark -T json -j "ip ip.flags http" -J ek|json|jsonraw|pdml . . . : tshark -T pdml -J "tcp http" -l (flush) . ( -V -V -l (pipe) . C C++ .) --update-interval 0 . TShark TShark . -L|--list-data-link-types (data link types) . -y . -o : (preference) . prefname:value prefname ( ) value . TShark . Wireshark . -O -V TShark protocols . "tshark -G protocols" . -p|--no-promiscuous-mode (promiscuous mode) . -p TShark (broadcast) (multicast) . . -i . -i -i . -P|--print -w -Q . -q . SIGINFO ( BSD ) <<>> ( control-T BSD ) . -z . -Q . . -q stderr . -z . -r|--read-file infile ( ). stdin (-) ( ). (pipe) TShark . -R|--read-filter ( / ) . . -2 . -Y . (forward-looking) 'response in frame #' . -s|--snapshot-length (snapshot length) . snaplen . 0 262144 . . -i . -i -i . . -S . -T ek|fields|json|jsonraw|pdml|ps|psml|tabs|text . : ek JSON (NDJSON) Elasticsearch. -j -J -x . -P -P -V . -P -V . Elasticsearch: tshark -T ek -j "http tcp ip" -P -V -x -r file.pcap > file.json curl -H "Content-Type: application/x-ndjson" -XPOST http://elasticsearch:9200/_bulk --data-binary "@file.json" Elastic *-packets Wireshark elastic . "tshark -G elastic-mapping" . --elastic-mapping-filter : tshark -G elastic-mapping --elastic-mapping-filter ip,udp,dns -G elastic-mapping: tshark -G elastic-mapping,ip,udp,dns fields -e -E . tshark -T fields -E separator=, -E quote=d (CSV) . json JSON. -j -J -x . : tshark -T json -r file.pcap tshark -T json -j "http tcp ip" -x -r file.pcap jsonraw JSON . -j -J . : tshark -T jsonraw -r file.pcap tshark -T jsonraw -j "http tcp ip" -x -r file.pcap pdml (Packet Details Markup Language) XML . -V . --color pdml . . ps PostScript -V . psml (Packet Summary Markup Language) XML . . --color pdml . . tabs text ASCII (0x09) . text -V . . --temp-dir ( ) . UNIX Linux macOS \*BSD Solaris AIX $TMPDIR ( /tmp) . Windows %TEMP% %USERPROFILE%\AppData\Local\Temp . -U PDU PDU (tap name) infile outfile . -Y . "" ? . -v|--version . -V TShark . -w | - outfile outfile '-' . -F --compress . ( ) gzip '.gz'. -w . ( '>') -w . -W . tshark -F pcapng -W n . TShark pcapng . : n ( pcapng) -x TShark / ( ) ASCII . --hexdump TShark ASCII ASCII . ( -x) . . : all hexdump hexdump . --hexdump frames . -x . frames hexdump hexdump . hexdump 'Bitstring tvb' 'Reassembled TCP' 'De-chunked entity body' hexdump . ascii hexdump ASCII . --hexdump delimit --hexdump noascii . -x ASCII . delimit hexdump ASCII '|'. ASCII . noascii hexdump ASCII. time hexdump . -t . notime hexdump . help --hexdump . --hexdump pcap pcapng Microsoft NetMon 2.x TShark Wireshark "Save as" . : hexdump ASCII text2pcap : tshark ... --hexdump frames --hexdump delimit --hexdump time -t ad \ | text2pcap -t 'ISO' - MYNEWPCAPNG hexdump ASCII UTC -a text2pcap : tshark ... --hexdump frames --hexdump time -t ud \ | text2pcap -a -t 'ISO' - MYNEWPCAPNG hexdump ASCII epoch text2pcap : tshark ... --hexdump frames --hexdump noascii --hexdump time -t e \ | text2pcap -t %s.%f - MYNEWPCAPNG -X TShark. (eXtension) extension_key:value extension_key : lua_script:lua_script_filename TShark Lua . lua_scriptnum:argument TShark lua 'num' 'lua_script' . '-X lua_script:my.lua' '-X lua_script1:foo' 'foo' 'my.lua' . '-X lua_script:my.lua' '-X lua_script:other.lua' '-X lua_script2:bar' 'bar' lua 'other.lua' . read_format:file_format TShark ( -r) . file_format . tshark -r rtcp_broken.pcapng -X read_format:"MIME Files Format" -V file-pcapng . -y|--linktype (data link type) . -L . . -i . -i -i . . -Y|--display-filter ( / ) . ( ) . -R . ( -2 ) ( ) . -M . tshark -M 100000 . -2 . -z TShark . -q . . filter ( ) . -z proto - . -q -V . : -z help -z. -z afp,srt[,filter] (SRT) Apple Filing Protocol. -z ancp,tree[,filter] Access Node Control Protocol (adjacency). -z ansi_a,bsmap[,filter] ANSI A-I/F BSMAP . -z ansi_a,dtap[,filter] ANSI A-I/F DTAP . -z ansi_map[,filter] ANSI MAP . -z asap,stat[,filter] Aggregate Service Access Protocol (ASAP). ASAP ASAP . -z bacapp_instanceid,tree[,filter] BACnet APDU (instance ID). . -z bacapp_ip,tree[,filter] BACnet APDU . (object ID) . -z bacapp_objectid,tree[,filter] BACnet APDU . . -z bacapp_service,tree[,filter] BACnet APDU . . -z calcappprotocol,stat[,filter] Calculation Application Protocol Reliable Server Pooling. . -z camel,counter[,filter] CAMEL opcode. -z camel,srt[,filter] (SRT) / CAMEL. CAMEL . -z collectd,tree[,filter] collectd. collectd (value segments) . -z componentstatusprotocol,stat[,filter] Calculation Status Protocol Reliable Server Pooling. . -z conv,type[,filter] (conversations) . type : "bluetooth" Bluetooth addresses "bpv7" Bundle Protocol Version 7 addresses "dccp" DCCP/IP socket pairs Both IPv4 and IPv6 are supported "dnp3" DNP3 addresses "eth" Ethernet addresses "fc" Fibre Channel addresses "fddi" FDDI addresses "ip" IPv4 addresses "ipv6" IPv6 addresses "ipx" IPX addresses "jxta" JXTA message addresses "ltp" LTP addresses "mptcp" Multipath TCP connections "ncp" NCP connections "openSAFETY" openSAFETY addresses "rsvp" RSVP connections "sctp" SCTP/IP socket pairs Both IPv4 and IPv6 are supported "sll" Linux "cooked mode" capture addresses "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported "tr" Token Ring addresses "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported "usb" USB addresses "wlan" IEEE 802.11 addresses "wpan" IEEE 802.15.4 addresses "zbee_nwk" ZigBee Network Layer addresses / / . . -z credentials ( /) . . . FTP HTTP IMAP POP SMTP. -z dcerpc,srt,uuid,major.minor[,filter] (SRT) / DCERPC uuid major.minor. MinSRT MaxSRT AvgSRT. : -z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0 CIFS SAMR . . : -z dcerpc,srt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4 SAMR SRT . -z dests,tree[,filter] IPv4 . -z dhcp,stat[,filter] DHCP (BOOTP). -z diameter,avp[,cmd.code,field,field,...] diameter . diameter diameter.cmd.code . diameter '*' diameter.cmd.code . : -z diameter,avp diameter. : -z diameter,avp,280 diameter DWR. : -z diameter,avp,272 diameter CC. diameter CC: tshark -r file.cap.gz -q -z diameter,avp,272,CC-Request-Type,CC-Request-Number,Session-Id,Subscription-Id-Data,Rating-Group,Result-Code diameter : "frame" Frame number. "time" Unix time of the frame arrival. "src" Source address. "srcport" Source port. "dst" Destination address. "dstport" Destination port. "proto" Constant string 'diameter', which can be used for post processing of tshark output. E.g. grep/sed/awk. "msgnr" seq. number of diameter message within the frame. E.g. '2' for the third diameter message in the same frame. "is_request" '0' if message is a request, '1' if message is an answer. "cmd" diameter.cmd_code, E.g. '272' for credit control messages. "req_frame" Number of frame where matched request was found or '0'. "ans_frame" Number of frame where matched answer was found or '0'. "resp_time" response time in seconds, '0' in case if matched Request/Answer is not found in trace. E.g. in the begin or end of capture. -z diameter,avp -V -T text -T pdml . -z diameter,avp -T field -z proto,colinfo . diameter . diameter diameter.Subscription-Id-Data diameter.Rating-Group. : tshark -q TShark . -z diameter,srt[,filter] (SRT) / Diameter. Diameter SRT SRT SRT SRT. . -z dis,streams DIS dis. (entity) DIS . -z dns,tree[,filter] DNS. qtype qclass . ( qname DNS) . -z endpoints,type[,filter] (endpoints) . type : "bluetooth" Bluetooth addresses "bpv7" Bundle Protocol Version 7 addresses "dccp" DCCP/IP socket pairs Both IPv4 and IPv6 are supported "dnp3" DNP3 addresses "eth" Ethernet addresses "fc" Fibre Channel addresses "fddi" FDDI addresses "ip" IPv4 addresses "ipv6" IPv6 addresses "ipx" IPX addresses "jxta" JXTA message addresses "ltp" LTP addresses "mptcp" Multipath TCP connections "ncp" NCP connections "openSAFETY" openSAFETY addresses "rsvp" RSVP connections "sctp" SCTP/IP socket pairs Both IPv4 and IPv6 are supported "sll" Linux "cooked mode" capture addresses "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported "tr" Token Ring addresses "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported "usb" USB addresses "wlan" IEEE 802.11 addresses "wpan" IEEE 802.15.4 addresses "zbee_nwk" ZigBee Network Layer addresses / / . . -z enrp,stat[,filter] Endpoint Handlespace Redundancy Protocol (ENRP). . -z expert[,error|,warn|,note|,chat|,comment][,filter] (expert info) (severity) . : -z expert,sip sip . . : -z "expert,note,tcp" tcp note . -z f1ap,tree[,filter] F1AP . -z f5_tmm_dist,tree[,filter] (TMM) F5. TMM F5. -z f5_virt_dist,tree[,filter] F5. ( ) ( ) F5. -z fc,srt[,filter] (SRT) / GTP. / SRT SRT SRT SRT Type ( ). . -z flow,name,mode[,filter] . ASCII . name . : any All frames icmp ICMP icmpv6 ICMPv6 lbm_uim UIM tcp TCP mode . : standard Any address network Network address : -z flow,tcp,network TCP -z follow,prot,mode,filter[,range] (stream) . . prot . : tcp TCP udp UDP dccp DCCP tls TLS or SSL dtls DTLS http HTTP streams http2 HTTP/2 streams quic QUIC streams mp2t MPEG-2 TS PIDs mpeg-pes MPEG-2 Packetized Element Stream sip SIP TShark Wireshark . mode . : ascii ASCII output with dots for non-printable characters carray C arrays of chars ebcdic EBCDIC output with dots for non-printable characters hex Hexadecimal and ASCII data with offsets raw Hexadecimal data utf-8 UTF-8 output with REPLACEMENT CHARACTERs for invalid sequences yaml YAML format ascii ebcdic utf-8 . ( utf-8 UTF-8 ). filter . : ip-addr0:port0,ip-addr1:port1 stream-index stream-index,substream-index IP TCP UDP DCCP . ( TCP TLS HTTP HTTP2 UDP DTLS QUIC MP2T MPEG-PS ). - (5-tuple) HTTP/2 QUIC MP2T . QUIC - (connection migration) . (stream indices) TCP UDP DCCP TLS DTLS HTTP ( HTTP TCP ). HTTP/2 QUIC MP2T MPEG-PES ( TCP HTTP/2 HTTP/2 QUIC QUIC MP2T PID MP2T MPEG-PS). range "" (chunks) . : -z "follow,tcp,hex,1" TCP ( ) "hex" . =================================================================== Follow: tcp,hex Filter: tcp.stream eq 1 Node 0: 200.57.7.197:32891 Node 1: 200.57.7.198:2906 00000000 00 00 00 22 00 00 00 07 00 0a 85 02 07 e9 00 02 ...".... ........ 00000010 07 e9 06 0f 00 0d 00 04 00 00 00 01 00 03 00 06 ........ ........ 00000020 1f 00 06 04 00 00 ...... 00000000 00 01 00 00 .... 00000026 00 02 00 00 : -z "follow,tcp,ascii,200.57.7.197:32891,200.57.7.198:2906" TCP 200.57.7.197 32891 200.57.7.98 2906 . =================================================================== Follow: tcp,ascii Filter: (omitted for readability) Node 0: 200.57.7.197:32891 Node 1: 200.57.7.198:2906 38 ..."..... ................ 4 .... : -z "follow,http2,hex,0,1" HTTP/2 TCP ( ) HTTP/2 . =================================================================== Follow: http2,hex Filter: tcp.stream eq 0 and http2.streamid eq 1 Node 0: 172.16.5.1:49178 Node 1: 172.16.5.10:8443 00000000 00 00 2c 01 05 00 00 00 01 82 04 8b 63 c1 ac 2a ..,..... ....c..* 00000010 27 1d 9d 57 ae a9 bf 87 41 8c 0b a2 5c 2e 2e da '..W.... A...\... 00000020 e1 05 c7 9a 69 9f 7a 88 25 b6 50 c3 ab b6 25 c3 ....i.z. %.P...%. 00000030 53 03 2a 2f 2a S.*/* 00000000 00 00 22 01 04 00 00 00 01 88 5f 87 35 23 98 ac .."..... .._.5#.. 00000010 57 54 df 61 96 c3 61 be 94 03 8a 61 2c 6a 08 2f WT.a..a. ...a,j./ 00000020 34 a0 5b b8 21 5c 0b ea 62 d1 bf 4.[.!\.. b.. 0000002B 00 40 00 00 00 00 00 00 01 89 50 4e 47 0d 0a 1a .@...... ..PNG... -z fractalgeneratorprotocol,stat[,filter] Fractal Generator Protocol Reliable Server Pooling. . -z gsm_a GSM A-I/F : BSSMAP DTAP Mobility Management DTAP Radio Resource Management DTAP Call Control DTAP GPRS Mobility Management DTAP SMS messages DTAP GPRS Session Management DTAP Supplementary Services DTAP Special Conformance Testing Functions SACCH Radio Resource Management. . -z gsm_a,category[,filter] category GSM A-I/F : bssmap BSSMAP dtap_cc DTAP Call Control dtap_gmm DTAP GPRS Mobility Management dtap_mm DTAP Mobility Management dtap_rr DTAP Radio Resource Management dtap_sacch SACCH Radio Resource Management dtap_sm DTAP GPRS Session Management dtap_sms DTAP Short Message Service dtap_ss DTAP Supplementary Services dtap_tp DTAP Special Conformance Testing Functions -z gsm_map,operation[,filter] GSM MAP. op code (invokes) . -z gtp,srt[,filter] (SRT) / GTP. SRT SRT SRT SRT . . -z gtpv2,srt[,filter] (SRT) / GTP. SRT SRT SRT SRT . . -z h225,counter[,filter] ITU-T H.225 . H.225 H.225 . . : -z h225,counter. : -z "h225,counter,ip.addr==1.2.3.4" H.225 IP 1.2.3.4 . . -z h225_ras,rtd[,filter] (RTD) ITU-T H.225 RAS. ITU-T H.225 RAS RTD RTD RTD . ( ) ( ) . : tshark -z h225_ras,rtd . : -z "h225_ras,rtd,ip.addr==1.2.3.4" ITU-T H.225 RAS IP 1.2.3.4 . -z hart_ip,tree[,filter] HART-IP . -z hosts[,ip][,ipv4][,ipv6] IPv4 / IPv6 "hosts". IPv4 IPv6 . "ip" IPv4 . "hosts" . -n. -z hpfeeds,tree[,filter] HPFEEDS opcode. -z http,stat[,filter] HTTP HTTP. -z http,tree[,filter] HTTP. . -z http_req,tree[,filter] HTTP . URI . -z http_seq,tree[,filter] HTTP URI URI . -z http_srv,tree[,filter] HTTP . HTTP IP . HTTP IP . -z http2,tree[,filter] HTTP/2. . -z icmp,srt[,filter] echo ICMP SRT ping . : -z icmp,srt,ip.src==1.2.3.4 ICMP SRT echo . . -z icmpv6,srt[,filter] echo ICMPv6 SRT ping . : -z icmpv6,srt,ipv6.src==fe80::1 ICMPv6 SRT echo . . -z io,phs[,filter] (Protocol Hierarchy Statistics) . . -z io,stat,interval[,filter][,filter][,filter]... / interval . Interval (us) . interval . filter . . : -z io,stat,1,ip.addr==1.2.3.4 / 1.2.3.4 . : -z "io,stat,0.001,smb&&ip.addr==1.2.3.4" SMB / 1.2.3.4 . . io,stat COUNT() SUM() MIN() MAX() AVG() LOAD() : -z io,stat,interval,"COUNT|SUM|MIN|MAX|AVG|LOAD(field)filter" . : -z io,stat,0.010,AVG(smb.time) . -z io,stat,0.010,AVG(smb.time)smb.time . . "." ! "," . COUNT - name ( ) . ''field'' . : -z io,stat,0.010,"COUNT(smb.sid)smb.sid" SID . SUM - COUNT . ''field'' . : tshark -z io,stat,0.010,"SUM(frame.len)frame.len" . MIN/MAX/AVG - . . . Read_AndX Read_AndX (SRT) . : DOS ''^'' : tshark -o tcp.desegment_tcp_streams:FALSE -n -q -r smb_reads.cap -z io,stat,0, "MIN(frame.time_relative)frame.time_relative and smb.cmd==0x2e and smb.flags.response==0", "MAX(frame.time_relative)frame.time_relative and smb.cmd==0x2e and smb.flags.response==1", "MIN(smb.time)smb.time and smb.cmd==0x2e", "MAX(smb.time)smb.time and smb.cmd==0x2e", "AVG(smb.time)smb.time and smb.cmd==0x2e" ====================================================================================================== IO Statistics Column #0: MIN(frame.time_relative)frame.time_relative and smb.cmd==0x2e and smb.flags.response==0 Column #1: MAX(frame.time_relative)frame.time_relative and smb.cmd==0x2e and smb.flags.response==1 Column #2: MIN(smb.time)smb.time and smb.cmd==0x2e Column #3: MAX(smb.time)smb.time and smb.cmd==0x2e Column #4: AVG(smb.time)smb.time and smb.cmd==0x2e | Column #0 | Column #1 | Column #2 | Column #3 | Column #4 | Time | MIN | MAX | MIN | MAX | AVG | 000.000- 0.000000 7.704054 0.000072 0.005539 0.000295 ====================================================================================================== PDU SMB PDU PDU SMB PDU SMB : tshark -n -q -r smb_reads_writes.cap -z io,stat,0, "AVG(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2e and smb.response_to", "SUM(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2e and smb.response_to", "AVG(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2f and not smb.response_to", "SUM(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2f and not smb.response_to" ===================================================================================== IO Statistics Column #0: AVG(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2e and smb.response_to Column #1: SUM(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2e and smb.response_to Column #2: AVG(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2f and not smb.response_to Column #3: SUM(smb.file.rw.length)smb.file.rw.length and smb.cmd==0x2f and not smb.response_to | Column #0 | Column #1 | Column #2 | Column #3 | Time | AVG | SUM | AVG | SUM | 000.000- 30018 28067522 72 3240 ===================================================================================== LOAD - (LOAD/Queue-Depth) . smb.time. . (LOAD) SMB . 1.0 / . tshark -n -q -r smb_reads_writes.cap -z "io,stat,0.001,LOAD(smb.time)smb.time" ============================================================================ IO Statistics Interval: 0.001000 secs Column #0: LOAD(smb.time)smb.time | Column #0 | Time | LOAD | 0000.000000-0000.001000 1.000000 0000.001000-0000.002000 0.741000 0000.002000-0000.003000 0.000000 0000.003000-0000.004000 1.000000 FRAMES | BYTES[()filter] - . ''()'' . : ( ) FRAMES BYTES SMB ( ) IP 10.1.0.64. tshark -o tcp.desegment_tcp_streams:FALSE -n -q -r smb_reads.cap -z io,stat,0,,FRAMES,BYTES, "FRAMES()smb.cmd==0x2e and smb.response_to","BYTES()ip.dst==10.1.0.64" ======================================================================================================================= IO Statistics Column #0: Column #1: FRAMES Column #2: BYTES Column #3: FRAMES()smb.cmd==0x2e and smb.response_to Column #4: BYTES()ip.dst==10.1.0.64 | Column #0 | Column #1 | Column #2 | Column #3 | Column #4 | Time | Frames | Bytes | FRAMES | BYTES | FRAMES | BYTES | 000.000- 33576 29721685 33576 29721685 870 29004801 ======================================================================================================================= -z ip_hosts,tree[,filter] IPv4 . -z ip_srcdst,tree[,filter] IPv4 . -z ip_ttl,tree[,filter] (TTL) IPv4 . -z ip6_dests,tree[,filter] IPv6 . -z ip6_hosts,tree[,filter] IPv6 . -z ip6_ptype,tree[,filter] IPv6 . -z ip6_srcdst,tree[,filter] IPv6 . -z ip6_hop,tree[,filter] (hop limits) IPv6 . -z isup_msg,tree[,filter] ISUP. ( ) . -z lbmr_queue_ads_queue,tree[,filter] LBM (LBM Topic Resolution Packets). . -z lbmr_queue_ads_source,tree[,filter] LBM. . -z lbmr_queue_queries_queue,tree[,filter] LBM. . -z lbmr_queue_queries_receiver,tree[,filter] LBM. . -z lbmr_topic_ads_source,tree[,filter] LBM. . -z lbmr_topic_ads_topic,tree[,filter] LBM. . -z lbmr_topic_ads_transport,tree[,filter] LBM. . -z lbmr_topic_queries_pattern,tree[,filter] LBM. . -z lbmr_topic_queries_pattern_receiver,tree[,filter] LBM. . -z lbmr_topic_queries_receiver,tree[,filter] LBM. . -z lbmr_topic_queries_topic,tree[,filter] LBM. . -z mac-3gpp,stat[,filter] MAC LTE NR . UE/TTI UE . : tshark -z mac-3gpp,stat. . : -z "mac-3gpp,stat,mac-lte.rnti>3000" UE LTE RNTI . -z megaco,rtd[,filter] (RTD) / MEGACO. ( -z smb,srt ). MEGACO RTD RTD RTD. / . : -z megaco,rtd. . : -z "megaco,rtd,ip.addr==1.2.3.4" MEGACO IP 1.2.3.4 . -z mgcp,rtd[,filter] (RTD) / MGCP. ( -z smb,srt ). MGCP RTD RTD RTD. / . : -z mgcp,rtd. . : -z "mgcp,rtd,ip.addr==1.2.3.4" MGCP IP 1.2.3.4 . -z mtp3,msus[,filter] MTP3 MSU. MSU MSU . -z ncp,srt[,filter] (SRT) / Netware Core Protocol. SRT SRT SRT SRT / (verb) . . -z oran-fh-cus,stat[,filter] ORAN FH CUS. -z osmux,tree[,filter] / OSmux. OSmux RTP AMR . -z pfcp,srt[,filter] (SRT) / PFCP. SRT SRT SRT SRT . . -z pingpongprotocol,stat[,filter] Ping Pong Protocol Reliable Server Pooling. . -z plen,tree[,filter] . (buckets) . -z proto,colinfo,filter,field field Info . Info . field Info . filter Info . field Info filter . TShark field field filter . TShark . "nfs.fh.hash" Info "nfs.fh.hash" : -z proto,colinfo,nfs.fh.hash,nfs.fh.hash "nfs.fh.hash" Info 1.2.3.4 : -z "proto,colinfo,nfs.fh.hash && ip.src==1.2.3.4,nfs.fh.hash" . -z ptype,tree[,filter] IPv4 . -z radius,rtd[,filter] (RTD) / RADIUS. RADIUS RTD RTD RTD ( ) ( ) . -z rlc-3gpp,stat[,filter] RLC LTE NR . UE . : tshark -z rlc-3gpp,stat. . : -z "rlc-3gpp,stat,rlc-nr.ueid>3000" UE NR UEId . -z rpc,programs SRT / / ONC-RPC. / MinSRT MaxSRT AvgSRT. . -z rpc,srt,program,version[,filter] (SRT) / program/version. MinSRT MaxSRT AvgSRT . : tshark -z rpc,srt,100003,3 NFS v3 . . : -z rpc,srt,100003,3,nfs.fh.hash==0x12345678 SRT NFS v3 . -z rtp,streams RTP . -z rtsp,stat[,filter] RTSP RTSP. -z rtsp,tree[,filter] RTSP. . -z sametime,tree[,filter] SAMETIME. . -z scsi,srt,cmdset[,filter] (SRT) / SCSI cmdset. 0:SBC 1:SSC 5:MMC. MinSRT MaxSRT AvgSRT. : -z scsi,srt,0 SCSI (SBC) . . : -z scsi,srt,0,ip.addr==1.2.3.4 SCSI SBC SRT iscsi/ifcp/fcip . -z sctp,stat (chunks) SCTP. SCTP (DATA, SACK, HEARTBEAT, HEARTBEAT ACK, INIT, INIT ACK, COOKIE ECHO, COOKIE ACK, ABORT, and ERROR) . -z sip,stat[,filter] SIP . SIP SIP . SIP ( SIP UDP) . : -z sip,stat. . : -z "sip,stat,ip.addr==1.2.3.4" SIP IP 1.2.3.4 . -z smb,sids TShark SID . SID . "Edit/Preferences/Protocols/SMB/Snoop SID to name mappings" -o "smb.sid_name_snooping:TRUE" TShark . TShark SID->name . -z smb,srt[,filter] (SRT) / SMB. SMB MinSRT MaxSRT AvgSRT. : -z smb,srt SMB Transaction2 NT Transaction . . xAndX SessionSetupAndX + TreeConnectAndX SessionSetupAndX . . . : -z "smb,srt,ip.addr==1.2.3.4" SMB IP 1.2.3.4 . -z smb2,srt[,filter] (SRT) / SMB. MinSRT MaxSRT AvgSRT SumSRT. (oplock break) . . -z smpp_commands,tree[,filter] SMPP. . -z snmp,srt[,filter] (SRT) / SNMP. PDU / MinSRT MaxSRT AvgSRT SumSRT. . -z someip_messages,tree[,filter] SOME/IP. / . -z someipsd_entries,tree[,filter] SOME/IP-SD. / . -z sv IEC 61850 Sampled Values. -z ucp_messages,tree[,filter] UCP. . -z wsp,stat[,filter] PDU WSP. --capture-comment . . Wireshark . --list-time-stamp-types . . --no-optimize libpcap . . . -i . -i -i . --time-stamp-type . --update-interval . . 100ms . --color Wireshark. Windows . ("true color") . . --no-duplicate-keys json ( -T json ). --json-compact JSON . ( -T json -T jsonraw ). --elastic-mapping-filter ,,... ElasticSearch ( Kibana) . . : ip,udp,dns . --export-objects , destdir. protocol --export-objects help . . (basename) . . . --print-timers JSON tshark . ( ) . --compress type. --compress . outfile . -d ==, Decode As... Wireshark . ( tcp.port udp.port TCP UDP) . . Decode As -d tcp.port==8888,http TCP 8888 HTTP . . Decode As -d tcp.port==8888-8890,http TCP 8888 8889 8890 HTTP . . Decode As -d tcp.port==8888:3,http TCP 8888 8889 8890 HTTP . . . Decode As -d . . . Decode As -d ethertype==0x0800,. ethertype . --disable-all-protocols . --disable-protocol [,,...] proto_name. (profile) ALL proto_name . --disable-heuristic (heuristic). --enable-protocol [,,...] proto_name. ALL proto_name . --disable-protocol --enable-protocol . . : --disable-protocol ALL --enable-protocol eth,ip --enable-heuristic (heuristic). -K kerberos keytab . . : -K krb5.keytab -n ( TCP UDP) -N (override) . -N . ( -n) . -n (preferences) -o . -N -n -N dmN . : d DNS g (geolocation) IP MaxMind m MAC n N ( DNS) n . s SNI (handshake) t v VLAN (single-pass mode) tshark (synchronous) . (dropped packets) . --only-protocols ( ) . . -t (a|ad|adoy|d|dd|e|r|rc|u|ud|udoy)[.[N]]|.[N] . : a (absolute): ad : YYYY-MM-DD adoy : YYYY/DOY d (delta): dd (delta_displayed): delta_displayed e (epoch): ( 00:00:00) r (relative): rc : u UTC: UTC "Z" ud UTC : YYYY-MM-DD UTC "Z" udoy UTC : YYYY/DOY UTC "Z" .[N] : N ( ). "." N . (relative) . -u -t ( relative delta delta_displayed) . : s hms . --log-level (log level) . "noisy" "debug" "info" "message" "warning" "critical" "error". "warning" "warning" "critical" "error" "noisy" . . --log-fatal (abort) . "warning" "warning" "critical" "error" . --log-fatal-count (fatal) . --log-domains (log domains) "GUI,Epan,sshdump". . "!" ( ). --log-debug "debug" . . "!" ( ). --log-noisy "noisy" . . "!" ( ). --log-fatal-domains . . --log-file stderr . (CAPTURE FILTER SYNTAX) pcap-filter(7) tcpdump(8) . (READ FILTER SYNTAX) TShark wireshark-filter(4) . (FILES) Wireshark . (Preferences) preferences ( ) . . . : -o ( ) . prefname:value prefname value (whitespace) : value . . # : # Vertical scrollbars should be on right side? # TRUE or FALSE (case-insensitive). gui.scrollbar_on_right: TRUE wireshark share . macOS /Application/Wireshark.app/Contents/Resources/share UNIX Linux \*BSD Solaris AIX /usr/share/wireshark/preferences /usr/local/share/wireshark/preferences C:\Program Files\Wireshark\preferences . UNIX $XDG_CONFIG_HOME/wireshark/preferences ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/preferences) $HOME/.config/wireshark/preferences . %APPDATA%\Wireshark\preferences ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\preferences) . () (Disabled (Enabled) Protocols) disabled_protos (dissectors) . : http tcp # a comment disabled_protos . disabled_protos . disabled_protos . disabled_protos ( postdissector) . enabled_protos . (Heuristic Dissectors) heuristic_protos . 0 1 : quic,1 rtcp_stun,1 rtcp_udp,1 rtp_stun,0 rtp_udp,0 tls_tcp,1 heuristic_protos . heuristic_protos . (hosts) hosts IPv4 IPv6 . hosts IP (whitespace) . hosts . UNIX Linux macOS \*BSD Solaris AIX libpcap Npcap . hosts Wireshark . (subnets) IPv4 ( ) subnets . subnets subnets . IPv4 / . IPv4 . : # Comments must be prepended by the # sign! 192.168.0.0/24 ws_test_network "subnet-name.remaining-address" . "192.168.0.1" "ws_test_network.1" 24 16 "ws_test_network.0.1" . (ethers) EUI-48 EUI-64 ethers . ethers ethers . ethers(5) . ( ) . (:) (-) (.) . . # . MAC EUI-64 . ethers : ff:ff:ff:ff:ff:ff Broadcast c0-00-ff-ff-ff-ff TR_broadcast 00.00.00.00.00.00 Zero_broadcast 00:00:00:00:00:00:00:00 EUI64_zero_broadcast ethers(5) UN*X . ethers UNIX Linux macOS \*BSD Solaris AIX /etc ( C:\Program Files\Wireshark) . ethers . UNIX libpcap Npcap . ethers Wireshark . (manuf) manuf MAC (netmask) . ethers : 00:00:0C Cisco Cisco Systems, Inc OUI : 00-00-0C-07-AC/40 All-HSRP-routers MAC . 00-00-0C-07-AC-00 00-00-0C-07-AC-FF . . manuf manuf . Wireshark IEEE manuf . tshark -G manuf . manuf wka . Wireshark MAC IEEE . (services) services . services services . services () . ( tcp udp sctp) / . : mydns 5045/udp # My own Domain Name Server mydns 5045/tcp # My own Domain Name Server Wireshark IANA services . tshark -G services . (ipxnets) ipxnets IPX . ipxnets . ethers . () IPX . ipxnets : C0.A8.2C.00 HR c0-a8-1c-00 CEO 00:00:BE:EF IT_Server1 110f FileServer3 ipxnets UNIX Linux macOS \*BSD Solaris AIX /etc ( C:\Program Files\Wireshark) . ipxnets . (ss7pcs) ss7pcs SS7 (point codes) . . () . : 2-1234 MyPointCode1 (vlans) vlans VLAN . . VLAN . : 123 Server-Lan 2049 HR-Client-LAN ( ) (Color Filters (Coloring Rules)) colorfilters . . : # a comment @tcp@tcp@[59345,58980,65534][0,0,0] @udp@udp@[28834,57427,65533][0,0,0] colorfilters . colorfilters . View:Coloring Rules . colorfilters colorfilters . (Plugins) Wireshark . UNIX Linux macOS \*BSD Solaris AIX lib/wireshark/plugins/ ( lib lib64 ) ( /usr/local/lib/wireshark/plugins/). $HOME/.local/lib/wireshark/plugins . macOS Wireshark (application bundle) %APPDIR%/Contents/PlugIns/wireshark . plugins/ ( C:\Program Files\Wireshark\plugins\) . %APPDATA%\Wireshark\plugins ( %APPDATA% %USERPROFILE%\Application Data\Wireshark\plugins) . Lua Wireshark ( X.Y) . Wireshark ( libwireshark libwiretap codecs). libwireshark foo.so (foo.dll ) PLUGINDIR/X.Y/epan ( libwireshark libepan codecs wiretap ). UNIX Lua ( ) $XDG_CONFIG_HOME/wireshark/plugins ( $XDG_CONFIG_HOME/wireshark $HOME/.wireshark $HOME/.wireshark/plugins). . Wireshark . TShark UTF-8 . . dissector UTF-8 . TShark UTF-8 . TShark TTY UNIX ( Linux macOS \*BSD Solaris AIX) locale UTF-8 locale . TShark Windows (dissection) UTF-16LE . UTF-8 . UTF-8 (chcp 65001) . (ENVIRONMENT VARIABLES) WIRESHARK_CONFIG_DIR . UNIX Linux macOS \*BSD Solaris AIX $XDG_CONFIG_HOME/wireshark ( $HOME/.wireshark $HOME/.wireshark) $HOME/.config/wireshark . Windows %APPDATA%\Wireshark ( %APPDATA% %USERPROFILE%\Application Data\Wireshark). Wireshark 3.0 . WIRESHARK_DEBUG_WMEM_OVERRIDE wmem backend backend . . README.wmem . WIRESHARK_RUN_FROM_BUILD_DIRECTORY ( ) . root ( setuid) UNIX Linux macOS \*BSD Solaris AIX . WIRESHARK_DATA_DIR . root ( setuid) UNIX . WIRESHARK_EXTCAP_DIR extcap . root ( setuid) UNIX . WIRESHARK_PLUGIN_DIR . root ( setuid) UNIX . ERF_RECORDS_TO_CHECK ERF ERF . (20) . IPFIX_RECORDS_TO_CHECK IPFIX IPFIX . (20) . WIRESHARK_ABORT_ON_DISSECTOR_BUG TShark dissector abort(3) . abort(3) TShark ( ) core dump . dissector . WIRESHARK_ABORT_ON_TOO_MANY_ITEMS dissector ( dissector ) TShark abort(3) . abort(3) TShark ( ) core dump . dissector . WIRESHARK_LOG_LEVEL (verbosity) . critical warning message info debug noisy . . critical error . WIRESHARK_LOG_FATAL (fatal) . (abort) . Error critical warning . Error . WIRESHARK_LOG_DOMAINS . . . . '!' . WIRESHARK_LOG_DEBUG debug. . '!' debug . WIRESHARK_LOG_NOISY noisy. wireshark-filter(4), wireshark(1), editcap(1), pcap(3), dumpcap(1), text2pcap(1), mergecap(1), pcap-filter(7) tcpdump(8) (NOTES) TShark 4.7.3 . TShark Wireshark . Wireshark : . HTML Wireshark : . (AUTHORS) TShark Wireshark Wireshark Wireshark . 2026-09-03 TSHARK(1)