tshark

tshark is Wireshark on the command line, strongest at reading a saved .pcap after the fact. A display filter with -Y keeps only packets that match a dissected field (http.request, ip.dst==10.0.2.10, http.request.method==POST), far richer than tcpdump's capture filter. -T fields -e prints just the fields you name, one line per packet, for tidy tables. -q -z runs statistics — -z conv,tcp and -z endpoints,ip summarise who talked to whom. -z follow,tcp,ascii,N reassembles one connection into readable text, and --export-objects http,DIR carves transferred files back out of the packets.

tshark command usage

tshark -r FILE [-Y DISPLAY_FILTER] [-T fields -e FIELD …]
tshark -r FILE -q -z conv,tcp | -z endpoints,ip | -z follow,tcp,ascii,N
tshark -r FILE --export-objects http,DIR

Options

-r file.pcap

read a saved capture instead of a live card

-Y FILTER

keep only packets matching a display filter

-T fields -e F

print only the named field(s), one line each

-q -z conv,tcp

print a statistic (conversations, endpoints, …) and nothing else

-z follow,tcp,ascii,N

reassemble TCP stream number N as text

--export-objects http,DIR

write each file transferred over HTTP into DIR

tshark examples

tshark -r incident.pcap -q -z conv,tcp

Lists the TCP conversations in the file and how much each exchanged.

tshark -r incident.pcap -Y http.request -T fields -e ip.dst -e http.host -e http.request.uri

Prints every HTTP request's destination, host and URL, one per line.

tshark -r incident.pcap -q -z follow,tcp,ascii,1

Reassembles the second TCP connection into readable text, payloads and all.

tshark -r incident.pcap --export-objects http,/tmp/objs

Carves every file transferred over HTTP out of the capture into a directory.

Pitfalls

• A display filter (-Y http.request) is not a capture filter (tcp port 80); tshark's two filter languages differ.
• It can only read what is in the capture: an encrypted (HTTPS) payload stays unreadable, though endpoints and timing do not.
• Stream numbers in follow,tcp,…,N start at 0, in the order connections opened.

Run it on real machines