Using tshark
Another useful tool for the analysis of pcap
files is tshark.
The tshark
tool is a console version WireShark. tshark
has virtually the same functionality as tcpdump,
but it adds the possibility of a WireShark protocol analyzer and uses syntax to filter.
To read a previously recorded pcap
file the -r
option is also used. The output format depends on the protocol. Thus, tshark
shows application-level information.
To obtain additional information, use the -V
option. To display packets in hex and ASCII formats, use the -x
option.
Tshark allows the use of filters capture when using syntax that is similar to tcpdump's BPF, and display filters can be used when the built-in protocol analyzers.
For the use of, filters should be used with the
Get Practical Windows Forensics now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.