But in our scenario, the interface which we are going to use is “eth0”. Let’s now try to capture traffic, we have various choice of interface to capture traffic and therefore one can choose whichever depending on their needs and requirement. And to check out these interfaces you can use the parameter -D as shown in the image below : tshark -D These interfaces can be specified using -i parameter which is used to specify the network whose traffic we want to capture. Each interface is referred to by their serial number and as you can see it is followed by a text description of the network interface. TShark prints a list of the interfaces whose traffic it can capture. To check out all the parameters, use the following command : tshark -h So let us start our learning process with TShark and therefore launch this tool and explore its options.

TShark is a command-line based tool, which can do anything that Wireshark does. pcap files to analyze the information, dig into the details of those connections, helping security professionals to identify their network problem. TShark is used to analyze real-time network traffic and it can read. TShark is capable of capturing the data packets information of different network layers and display them in different formats. It’s working structure is quite similar to Tcpdump, but it has some powerful decoders and filters. Tshark, a well known and powerful command-line tool and is used as a network analyzer. It is defined as the average data traffic intensity and time period of its network data packet study. Network traffic volume is the measure of the total work done. Traffic volume is a term which comes under network traffic analyzing. As a benefit, if there is some unusual amount of data traffic in a network which is a possible sign of an attack then Tshark can help us know before it too late and the attack can be terminated as data traffic reports provide insights into preventing some good attacks. Analyzing these network packets provides network security as it helps us to monitor traffic. Network data, in computer networks, is in the form of network data packets.

Difference between decoded packets and encoded packetsĪs we know, network traffic or data traffic is the amount of data transferring across the network at some given point of time.

Capture the interface in promiscuous mode.It also allows us, to read or analyze the previously captured data packets of a saved file. It lets us capture the data packets, from the live network. In this article, we will learn about TShark which is a well-known network protocol analyzer.

Tshark commands