TSHARK
TShark is considered a CLI version of Wireshark and shares the same display filters. it is often preferred over Wireshark when handling large packet captures (PCAPs) over a gigabyte in size. it has several advantages over Wireshark including processing packets in a streaming fashion to reduce memory usage, integration with scripts for automation, operates faster without GUI overhead, and allows on-the-fly packet filtering to improve efficiency.
COMMON PARAMETERS


VERSION INFO
root@dco:~$ tshark -v
TShark (Wireshark) 3 (Git v3. packaged as 3.)
Copyright 1998-2020 Gerald Combs and contributors. License GPLv2+: GNU GPL version 2 or later.
This is free software; see the source for copying conditions.
COLORIZED OUTPUT
this help analysts speed up analysis and spot anomalies quickly by using Wireshark-style packet highlighting
root@dco:~$ tshark --color
Last updated