In fact, you do need to have a deep understanding of concepts of computer networks and related protocols like TCP/IP etc. For this guide, we will be using Kali Linux which comes pre-shipped with both the WireShark and TShark. In this tutorial, we will explain to you about TShark and present you with some basic use cases.

Like Wireshark, TShark is available for major operating systems: Linux, Mac OS, Windows. The drawback is of course that it does not have a GUI. The benefit of using TShark is that it can be included in scripts (it can be used inside a python script) and can be used on remote systems via SSH. The default capture file format is pcapng which is the same as used by Wireshark. captured packets can be stored in a file and later retrieved for analysis. All the options used in Wireshark are also supported here. This is particularly helpful when a GUI is not available. Most people are unaware of TShark as opposed to commonly used Wireshark. Sudo rm -rf /etc/apt//wireshark-dev-ubuntu-stable-focal.TShark is designed as a CLI or command-line interface of Wireshark for capturing and analyzing packets right from the CLI. Remove GPG key and repository: sudo rm -rf /etc/apt//wireshark-dev_ubuntu_stable.gpg If you wish to completely remove TShark and all related dependencies, execute the following command: sudo apt purge -autoremove -y tshark The -i option allows to capture packets on specific network interface. We can find network interfaces which are available to the TShark with command: tshark -D

After reconnection, you can check TShark version: tshark -versionĮxecute tshark command without any arguments to start capturing packets on default network interface: tshark In order to make changes to take effect, logout and login to your machine. Run the following command to add current user to a wireshark group: sudo usermod -a -G wireshark $USER It will add wireshark group and anyone who is a member of this group will be able to capture packets without being root user. Install TShark: sudo apt install -y tsharkĭuring installation you will be asked if you want to allow non-root users to able to capture packets. Install TSharkĪdd the Wireshark and TShark repository: sudo add-apt-repository -y ppa:wireshark-dev/stable This tutorial demonstrates how to install TShark on Ubuntu 20.04. TShark is a command line version of Wireshark that can be used when graphical user interface isn't available. This tool enables to capture packets from a network and print them to the standard output. TShark is a command line tool for analyzing network traffic.

Wireshark command line not found