LOADING N0PERM…
Terminal-based Wireshark engine designed for automated capture dissection, field extraction, and command-line network forensics pipelines.
A standard PACKET_ANALYSIS utility used across offensive reconnaissance, packet forensics, and defensive system administration.
Direct visibility into network interfaces, protocol frames, access controls, or filesystem structures without graphical overhead.
During live system triage, initial reconnaissance, forensic capture inspection, or baseline configuration auditing.
# Debian / Ubuntu
sudo apt install tshark
# macOS
brew install wireshark --with-tsharkField extraction examples:
- Read PCAP and extract IP endpoints: tshark -r capture.pcap -T fields -e ip.src -e ip.dst
- Extract DNS query names: tshark -r capture.pcap -Y 'dns.flags.response == 0' -T fields -e dns.qry.name
- Follow stream: tshark -r capture.pcap -q -z follow,tcp,ascii,0