About
Tshark is the command-line side of Wireshark. Read and filter packet captures without a graphical interface. It also pulls statistics out of traffic you have already recorded.
Install it
pkg install tshark
Run this inside Termux. If the package is already present, pkg will say so and
do nothing.
Commands worth knowing
6 of the invocations you will actually reach for. Tap the copy button to put one on your clipboard.
tshark -r capture.pcap Read a saved capture file. Every packet gets a one-line summary. tshark -r capture.pcap -c 20 Stop after the first twenty packets. Handy for peeking at a large file. tshark -i any Record live traffic from every interface. Packets print as they arrive, so stop with Ctrl-C. tshark -r capture.pcap -Y http.request Apply a display filter, so only matching packets show. Here, HTTP requests. tshark -r capture.pcap -z io,phs Print a protocol hierarchy breakdown. See which protocols account for how much traffic. tshark -r capture.pcap -T fields -e ip.src -e ip.dst Emit chosen fields as a plain table. Handy when feeding addresses into another script. Worked example
Run tshark -r capture.pcap -c 3 and this is what you should see.
$ tshark -r capture.pcap -c 3
1 0.000000 192.168.1.5 -> 93.184.216.34 TCP 74 443 -> 51234 [SYN]
2 0.000021 93.184.216.34 -> 192.168.1.5 TCP 74 51234 -> 443 [SYN, ACK]
3 0.000089 192.168.1.5 -> 93.184.216.34 TCP 66 443 -> 51234 [ACK] Each line is one packet, with its number, timestamp, endpoints and flags.
Developed by
The Wireshark Foundation .