Instructs TShark to create 10 files ( -a files:10) containing the packets captured in the ring buffer mode of operation, each file containing 1024 KB (1MB).Once the first file size is full, TShark moves on to the next file, and so on. In this mode, TShark writes captured packets to numbered files. Sets the capture ring buffer option ( -b), which brings up the multiple files mode.Run the below command to store packets captured to a file. In this case, you can use TShark to save the captured packets and share them with your friends or colleague who you think can help. Scrolling through the packets in the terminal won’t always give out information to understand what’s causing the issue. So why not save the captured packets to a file? For example, your SSH connection has been working fine, and suddenly the connection is not available. But perhaps you don’t have time to troubleshoot at the moment. Viewing captured packets in real-time lets you immediately act for troubleshooting. This command updates your system’s list of packages and their current versions.Ĭapturing Packets using Display Filter Saving Captured Packets to a File Run the apt update command below to ensure your package manager is up to date. Related: Learning Ubuntu Apt Get Through Examplesġ. But for this demo, you’ll install using the APT package manager. Using your package manager, you can install on most Linux distributions and BSD operating systems. TShark doesn’t come installed on your Linux distro by default, so before you can take advantage of this, kick off this tutorial by installing TShark on your machine. A Linux machine – This tutorial uses Ubuntu 20.04 LTS, but any Linux distributions will work.If you’d like to follow along, be sure you have the following. This tutorial will be a hands-on demonstration. Read on and never waste hours analyzing your packet captures again! Prerequisites

One thing that makes this great is that instead of clicking multiple buttons and digging through various menus, you can type just one command to get the information you need. TShark is the equivalent of Wireshark GUI, which provides valuable information about traffic captured in your network. One way to optimize packet capture is to use a command-line interface tool, and out of all the tools you can find, TShark is one you must try.

Tshark commands