Wireshark: extracting fields with tshark
With tshark, Wireshark’s command-line sibling, and its helpers (capinfos, editcap) you summarise a capture, filter it, extract the fields you want as a table, produce statistics and write a new capture file; at the end you extract cleartext FTP credentials and write a detection script that finds data exfiltration over DNS and works on other captures too. The capture differs in every lab.
Level 101 · 50 min
Elif’s morning job: asking the same questions of dozens of capture files collected overnight. "I can’t open each one in Wireshark. I write my questions on the command line and pour the result into a table."
tshark uses Wireshark’s same dissection engine without the graphical interface: the same filters (-Y), the same field names (-e http.host), but the output is text; it goes to other commands through a pipe (|), into scripts, and gets automated.
In this lesson you do everything in the terminal on the desktop. The capture: ~/captures/day.pcapng. Save your outputs in the ~/tshark folder; the checks look there. tshark prints a "could be dangerous" warning when it runs as root; you can ignore it in this lab.
What you will do in this lesson
- Summary first: capinfos
- Read: tshark -r and -c
- Filter and extract fields: -Y, -T fields, -e
- Make a table: header and separator
- Statistics: -q -z conv,tcp
- The HTTP tree: -z http,tree
- Write a new capture: -w
- Cleartext credentials
- A detection script: data exfiltration over DNS
- Short quiz
Skills you will earn
- Reading captures with tshark and capinfos
- Extracting fields and making tables with tshark (-T fields, -E)
- Producing statistics with tshark (-z)
- Writing filtered packets to a new file (-w)
- Finding cleartext credentials in traffic
- Writing a detection script for data exfiltration over DNS
← IPv6 and ICMPv6 traffic with Wireshark · Wireshark fundamentals · Capstone: find the suspicious traffic with Wireshark →
Start for free