Tshark Cheat Sheet

Tshark is Wireshark's command-line sibling — the same packet capture and dissection engine, without the GUI. It's what you reach for when you need to capture or analyze traffic on a remote box over SSH, in a script, or anywhere a graphical interface isn't available.

Red Team / Offensive Use

On an engagement, tshark shows up on both sides: capturing traffic to confirm a payload actually reached its target, verifying what a service really sends over the wire when documentation is wrong or missing, or — during an authorized assessment of internal network segmentation — checking whether traffic that should be blocked is actually reaching where you're standing. Blue-team side, it's a core tool for filtering a large capture down to exactly the packets relevant to an investigation without opening a multi-gigabyte file in a GUI.

Established Cheatsheet

Tshark man page — Wireshark — the official reference for every command-line flag and display filter syntax.

PWNMI's Top 5 Use Cases

• tshark -i eth0 — capture live traffic on an interface, printed to the terminal as it arrives
• tshark -i eth0 -w capture.pcap — capture to a file instead of printing, for later analysis in Wireshark itself or a repeat tshark pass
• tshark -r capture.pcap -Y "http.request" — read an existing capture and apply a display filter; the same filter syntax Wireshark's GUI uses
• tshark -i eth0 -f "port 445" — apply a capture filter (BPF syntax, different from display filter syntax) to only capture traffic on a specific port, keeping the capture small and relevant
• tshark -r capture.pcap -Y "ftp.request.command==\"USER\" or ftp.request.command==\"PASS\"" — pull out credentials sent in cleartext, useful for demonstrating the real impact of an unencrypted protocol during a report

Next step

For live host and port discovery before you get to packet-level analysis, see Nmap Fundamentals. For the OSINT and recon phase that usually precedes any of this, see OSINT Fundamentals.