Using CLI tools with Wireshark

Wireshark has several CLI tools that complement its basic functionality and will allow you to perform several tasks, such as editing, splitting, and manipulating packet captures. The following table is a summary of some of the tools available:

Table 2.1 – Wireshark’s built-in CLI tools

All of the CLI tools are baked into Wireshark, however, they are also available to use as a lightweight solution when working work with packet captures.

Next, let’s take a look at tshark, which is a great alternative to use when you need to conserve resources.

Exploring tshark

Part of the Ethereal development process included Terminal Ethereal (Tethereal), which was a CLI tool. Tethereal was later renamed Terminal Wireshark (tshark).

To capture using tshark on a Windows machine, go into the CLI and build a command as the following example shows:

C:\Program Files\Wireshark>tshark -i “ethernet 2”...