There are two ways: the first is to look up the display field reference. '06:36:05.109737000','10.2.3.5','192.168.0.3','IN s1/tmm1 : NTP Version 3, client'īreaking down that command line we have: Optionĭisplay filter to select what packets to showīut where does one find out the field name for the desired field? Such an example command line might look like: $ tshark.exe -r -2 -R 'ip.addr=10.2.3.5' -T fields -E separator=, -E quote=d -e frame.time -e ip.src -e ip.dst -e _ws.col.Info

Just as you can configure what columns to display in the packet summary in Wireshark – you can tell TShark what fields to display from the command line. In this case the TShark tool is very useful.

For each network interface, a number and an interface name, possibly followed by a text description of the interface, is printed. Running Wireshark from a command line In this section, well take a look at how to run Wireshark What well do is run Wireshark.exe then, if you press Enter.

Sometimes you want to process packet captures from the command line rather than from Wireshark’s GUI. Example: tcp.port8888,http -D, -list-interfaces Print a list of the interfaces on which Wireshark can capture, then exit.

Wireshark command line example