LFCE 96 🐧 tshark — Reading Packets - KandZ

⏱️ Estimated read: 14 min | |

tshark is the command-line version of Wireshark, and it is the tool that turns a packet capture into a decoded, searchable, scriptable data source. The previous chapter covered tcpdump, which captures packets and prints a summary of each one; tshark uses the same pcap capture library, but it applies the full Wireshark protocol dissector to every packet, which means it can decode the application-layer protocols—HTTP, DNS, TLS, SMB—that tcpdump treats as opaque payload . The LFCE exam expects the candidate to monitor and troubleshoot network performance, and tshark is the tool that answers the question “what is inside the packet” rather than “what are the headers.”

Quick How-To Guides & Fast FixesNeed a quick fix or step-by-step solution? Browse our fast answers on HowTo.KandZ.me:

Operating Systems CLI →Dev Environment Languages →Web Network Tools →Security Accounts →Security Access Tech →Device Phone Basics →Social Messaging →Digital Files Media →

The capture side of tshark is similar to tcpdump: the -i option selects the interface, the -f option sets the BPF capture filter, and the -w option writes the pcap file. The difference is on the analysis side. The -r option reads a pcap file, and the -Y option applies a display filter that uses the Wireshark field syntax rather than the BPF syntax . The -T fields option extracts the specific fields, and the -e option names the field to extract. The -z option computes the statistics, such as the conversation summaries and the protocol hierarchy, and the -q option suppresses the packet output so that only the statistics are printed .

Key point: tshark has two filter languages. The capture filter (-f) uses the BPF syntax and is evaluated in the kernel during the live capture. The display filter (-Y) uses the Wireshark field syntax and is evaluated in the userspace during the analysis . The display filter is the more powerful of the two, because it can match on the decoded protocol fields such as http.request.method and dns.qry.name, which the BPF filter cannot see. The -T fields -e <field> combination is the mechanism that turns a packet capture into a tab-separated table that can be piped to awk, sort, and uniq.

Why tshark requires the display filter

The protocol-field problem.

The BPF filter matches the packet bytes at a fixed offset, which is sufficient for the IP addresses and the TCP ports, but it cannot match the application-layer fields that are encoded in a variable-length payload. The HTTP method is a string at the start of the TCP payload, and the DNS query name is a sequence of length-prefixed labels. The Wireshark dissector parses these fields and exposes them as named fields, and the display filter matches against the parsed values . The -Y 'http.request.method == "GET"' filter is the mechanism that selects the HTTP GET requests, which the BPF filter cannot express.

The two-pass problem.

Some fields, such as the “response in frame #” and the TCP stream reassembly, require the knowledge of the future packets. The single-pass analysis cannot compute them because the future packets have not been parsed yet. The -2 option performs the two-pass analysis: the first pass parses all the packets, and the second pass fills in the forward-looking fields . The -R option applies the read filter during the first pass, which is the mechanism for the large captures where the second pass would be too slow.

The output-format problem.

tshark can output the packets in several formats: the default text summary, the verbose detail (-V), the JSON (-T json), the Elasticsearch bulk format (-T ek), and the field table (-T fields). The -T fields format is the one that makes tshark scriptable, because it produces a line per packet with the selected fields separated by a delimiter . The -E separator=, option sets the delimiter, and the -E header=y option prints the field names as the first line. The result is a CSV that can be processed by any tool.

a. Reading and filtering the capture

The -r option reads the pcap file, and the -Y option applies the display filter.

# Read the capture and show the packet summary
tshark -r capture.pcap

# Filter the HTTP traffic
tshark -r capture.pcap -Y 'http'

# Filter by the IP address
tshark -r capture.pcap -Y 'ip.addr == 192.168.1.50'

# Filter the TCP resets
tshark -r capture.pcap -Y 'tcp.flags.reset == 1'

# Filter the DNS queries
tshark -r capture.pcap -Y 'dns.flags.response == 0'

The -r capture.pcap reads the file, and the -Y filter selects the packets that match the expression . The http filter matches the packets that the dissector recognized as HTTP, and the ip.addr filter matches the source or the destination address. The tcp.flags.reset == 1 filter matches the TCP resets, and the dns.flags.response == 0 filter matches the DNS queries rather than the responses.

The display filter supports the comparison operators and the logical operators.

# HTTP requests to a specific host
tshark -r capture.pcap -Y 'http.host == "example.com"'

# HTTP GET or POST requests
tshark -r capture.pcap -Y 'http.request.method in {"GET", "POST"}'

# Packets larger than 1000 bytes
tshark -r capture.pcap -Y 'frame.len > 1000'

# TLS handshakes with a specific version
tshark -r capture.pcap -Y 'tls.handshake.version == 0x0303'

The http.host filter matches the Host header, and the in operator matches a set of values . The frame.len filter matches the packet length, and the tls.handshake.version filter matches the TLS version field.

b. Extracting the fields

The -T fields -e <field> combination extracts the specific fields and prints them as a table.

# Extract the source and destination IPs
tshark -r capture.pcap -T fields -e ip.src -e ip.dst -E header=y

# Extract the HTTP method, URL, and response code
tshark -r capture.pcap -Y 'http' \
  -T fields \
  -e http.request.method \
  -e http.request.uri \
  -e http.response.code \
  -E separator=,

# Extract the DNS query names
tshark -r capture.pcap -Y 'dns.flags.response == 0' \
  -T fields -e dns.qry.name

# Extract the TLS server names
tshark -r capture.pcap -Y 'tls.handshake.extensions_server_name' \
  -T fields -e tls.handshake.extensions_server_name

The -e option names the field to extract, and the -T fields option prints one line per packet with the selected fields . The -E header=y option prints the field names as the first line, and the -E separator=, option sets the comma as the delimiter. The HTTP extraction is the mechanism for the application-layer analysis: the method, the URL, and the response code are the fields that answer “what did the client request and what did the server return.”

The extracted fields can be piped to the other tools.

# Count the HTTP requests per host
tshark -r capture.pcap -Y 'http.request' \
  -T fields -e http.host | sort | uniq -c | sort -rn

# Find the top talkers
tshark -r capture.pcap -T fields -e ip.src | sort | uniq -c | sort -rn | head

The sort | uniq -c | sort -rn pipeline counts the occurrences and sorts them in the descending order, which is the mechanism for the top-talker and the request-distribution analysis.

c. The statistics and the conversation analysis

The -z option computes the statistics, and the -q option suppresses the packet output.

# Protocol hierarchy
tshark -r capture.pcap -q -z io,phs

# TCP conversations
tshark -r capture.pcap -q -z conv,tcp

# Endpoint statistics (top talkers)
tshark -r capture.pcap -q -z endpoints,ip

# HTTP request statistics
tshark -r capture.pcap -q -z http,tree

# Expert information (warnings and errors)
tshark -r capture.pcap -q -z expert

The -q option tells tshark not to print the packet information, so the output contains only the statistics . The io,phs statistic shows the protocol hierarchy, which is the breakdown of the traffic by the protocol. The conv,tcp statistic shows the TCP conversations, which is the list of the connections with the byte counts and the durations . The endpoints,ip statistic shows the top talkers, and the expert statistic shows the warnings and the errors that the dissector detected.

The -z statistics can be combined with the display filter to scope the analysis.

# TCP conversations for a specific host
tshark -r capture.pcap -q -z conv,tcp -Y 'ip.addr == 192.168.1.50'

The -Y filter restricts the packets that the statistics consider, which is the mechanism for the host-specific and the protocol-specific summaries.

Complete Example Session

# ============================================
# PART 1: READ THE CAPTURE
# ============================================
tshark -r capture.pcap
# Output shows the packet summary

# ============================================
# PART 2: FILTER THE HTTP TRAFFIC
# ============================================
tshark -r capture.pcap -Y 'http'
# Output shows only the HTTP packets

# ============================================
# PART 3: EXTRACT THE HTTP FIELDS
# ============================================
tshark -r capture.pcap -Y 'http' \
  -T fields -e http.request.method -e http.request.uri -e http.response.code
# Output shows the method, URL, and response code

# ============================================
# PART 4: EXTRACT THE DNS QUERIES
# ============================================
tshark -r capture.pcap -Y 'dns.flags.response == 0' \
  -T fields -e dns.qry.name
# Output shows the queried names

# ============================================
# PART 5: FILTER THE TCP RESETS
# ============================================
tshark -r capture.pcap -Y 'tcp.flags.reset == 1'
# Output shows the connection resets

# ============================================
# PART 6: PROTOCOL HIERARCHY
# ============================================
tshark -r capture.pcap -q -z io,phs
# Output shows the protocol breakdown

# ============================================
# PART 7: TCP CONVERSATIONS
# ============================================
tshark -r capture.pcap -q -z conv,tcp
# Output shows the connections and the byte counts

# ============================================
# PART 8: TOP TALKERS
# ============================================
tshark -r capture.pcap -T fields -e ip.src | sort | uniq -c | sort -rn | head
# Output shows the top source addresses

# ============================================
# PART 9: TWO-PASS ANALYSIS
# ============================================
tshark -r capture.pcap -2 -R 'http'
# Output shows the HTTP packets with the forward-looking fields

# ============================================
# PART 10: SAVE THE FILTERED SUBSET
# ============================================
tshark -r capture.pcap -Y 'http' -w http-only.pcap
# The HTTP packets are saved to a new file

The ten parts demonstrate the tshark surface: the read, the HTTP filter, the field extraction, the DNS query extraction, the TCP reset filter, the protocol hierarchy, the TCP conversations, the top talkers, the two-pass analysis, and the filtered subset. The critical extraction is Part 3: the method, URL, and response code are the fields that answer the application-layer question.

Quick Reference

Capture and Read Options

Option	Purpose
`-i <if>`	Capture interface
`-f <filter>`	BPF capture filter
`-w <file>`	Write to pcap
`-r <file>`	Read from pcap
`-Y <filter>`	Display filter
`-R <filter>`	Read filter (with `-2`)
`-2`	Two-pass analysis

Output Options

Option	Purpose
`-T fields`	Field table output
`-e <field>`	Field to extract
`-E separator=,`	Field delimiter
`-E header=y`	Print the field names
`-V`	Verbose packet detail
`-q`	Suppress the packet output
`-z <stat>`	Compute the statistics

Display Filter Examples

Filter	Matches
`http`	HTTP packets
`http.request.method == "GET"`	GET requests
`ip.addr == 192.168.1.50`	Source or destination
`tcp.flags.reset == 1`	TCP resets
`dns.flags.response == 0`	DNS queries
`frame.len > 1000`	Large packets

Statistics

Statistic	Purpose
`io,phs`	Protocol hierarchy
`conv,tcp`	TCP conversations
`endpoints,ip`	Top talkers
`http,tree`	HTTP request breakdown
`expert`	Warnings and errors

Best Practices

✅ Do This:

# Use the display filter for the protocol fields
tshark -r capture.pcap -Y 'http.request.method == "GET"'       # ✅

# Extract the fields for the scripting
tshark -r capture.pcap -T fields -e ip.src -e ip.dst           # ✅

# Use -q with the statistics
tshark -r capture.pcap -q -z conv,tcp                          # ✅

# Use the two-pass analysis for the forward-looking fields
tshark -r capture.pcap -2 -R 'http'                            # ✅

# Pipe the fields to the other tools
tshark -r capture.pcap -T fields -e http.host | sort | uniq -c # ✅

❌ Don’t Do This:

# Use the BPF syntax in the display filter
tshark -r capture.pcap -Y 'tcp port 80'    # Use 'tcp.port == 80' # ❌

# Forget the -T fields for the extraction
tshark -r capture.pcap -e ip.src    # Prints the summary        # ❌

# Use the live capture without the capture filter
tshark -i eth0    # Overwhelming output                        # ❌

# Ignore the two-pass for the forward-looking fields
tshark -r capture.pcap -Y 'http.response_in'    # Empty         # ❌

# Use the display filter on the live capture without -f
tshark -i eth0 -Y 'http'    # The live capture needs -f         # ❌

Common Pitfalls

Pitfall	Why It Happens	Fix
The filter syntax error	Used the BPF syntax in the display filter	Use the Wireshark field syntax
No output from `-e`	Missing `-T fields`	Add `-T fields`
The forward-looking field is empty	No two-pass analysis	Add `-2`
The live capture is slow	No capture filter	Add `-f`
The statistics include the unwanted packets	No display filter	Add `-Y`

Real-World Examples

1. Read a capture

tshark -r capture.pcap

2. Filter HTTP

tshark -r capture.pcap -Y 'http'

3. Extract the HTTP fields

tshark -r capture.pcap -Y 'http' -T fields -e http.request.method -e http.request.uri

4. Extract the DNS queries

tshark -r capture.pcap -Y 'dns.flags.response == 0' -T fields -e dns.qry.name

5. Filter the TCP resets

tshark -r capture.pcap -Y 'tcp.flags.reset == 1'

6. Protocol hierarchy

tshark -r capture.pcap -q -z io,phs

7. TCP conversations

tshark -r capture.pcap -q -z conv,tcp

8. Top talkers

tshark -r capture.pcap -T fields -e ip.src | sort | uniq -c | sort -rn | head

9. Two-pass analysis

tshark -r capture.pcap -2 -R 'http'

10. Save the filtered subset

tshark -r capture.pcap -Y 'http' -w http-only.pcap

Visual

The Two Filter Languages

┌──────────────────────────────────────────────────────────────┐
│  CAPTURE FILTER (-f) VS DISPLAY FILTER (-Y)                  │
│                                                              │
│  Capture filter (-f):                                        │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ BPF syntax: 'tcp port 80'                              │  │
│  │ Evaluated in the kernel during the live capture        │  │
│  │ Matches the packet bytes at the fixed offset           │  │
│  │ Cannot see the application-layer fields                │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  Display filter (-Y):                                        │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ Wireshark syntax: 'http.request.method == "GET"'       │  │
│  │ Evaluated in the userspace during the analysis         │  │
│  │ Matches the decoded protocol fields                    │  │
│  │ Can see the HTTP, DNS, TLS, SMB fields                 │  │
│  └────────────────────────────────────────────────────────┘  │
└──────────────────────────────────────────────────────────────┘

The Field Extraction

┌──────────────────────────────────────────────────────────────┐
│  -T fields -e <field> PRODUCES A TABLE                       │
│                                                              │
│  tshark -r capture.pcap -Y 'http'                            │
│    -T fields -e http.request.method -e http.request.uri      │
│                                                              │
│  Output:                                                     │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ GET     /index.html                                    │  │
│  │ POST    /api/login                                     │  │
│  │ GET     /images/logo.png                               │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  The output can be piped to sort, uniq, awk, and the other   │
│  text-processing tools.                                      │
└──────────────────────────────────────────────────────────────┘

The Statistics

┌──────────────────────────────────────────────────────────────┐
│  -q -z <stat> COMPUTES THE SUMMARY                           │
│                                                              │
│  tshark -r capture.pcap -q -z conv,tcp                       │
│       │                                                      │
│       ▼                                                      │
│  ┌────────────────────────────────────────────────────────┐  │
│  │ TCP Conversations                                      │  │
│  │ 192.168.1.50:443 <-> 10.0.0.5:54321  bytes: 15000     │  │
│  │ 192.168.1.50:80  <-> 10.0.0.6:54322  bytes: 2500      │  │
│  └────────────────────────────────────────────────────────┘  │
│                                                              │
│  The conversation summary shows who talked to whom and      │
│  how much data was transferred.                              │
└──────────────────────────────────────────────────────────────┘

Summary

Item	Value
Read a capture	`-r <file>`
Display filter	`-Y <filter>`
Capture filter	`-f <filter>`
Field extraction	`-T fields -e <field>`
Field delimiter	`-E separator=,`
Two-pass analysis	`-2`
Statistics	`-z <stat>` with `-q`
Protocol hierarchy	`-z io,phs`
TCP conversations	`-z conv,tcp`
Top talkers	`-z endpoints,ip`
Wireshark field syntax	`http.request.method`, `dns.qry.name`

Key takeaways:

tshark is the command-line Wireshark. It uses the same pcap capture library as tcpdump, but it applies the full Wireshark protocol dissector, which means it can decode the application-layer protocols that tcpdump cannot . The -Y display filter matches the decoded fields, and the -T fields extraction produces the scriptable output.
The display filter uses the Wireshark field syntax, not the BPF syntax. The http.request.method == "GET" and the dns.qry.name are the fields that the dissector exposes. The BPF syntax tcp port 80 is the capture filter (-f), not the display filter (-Y) .
The -T fields -e <field> combination is the mechanism for the scripting. The output is a table with the selected fields, and the -E separator=, and -E header=y options control the format. The result can be piped to sort, uniq, and awk for the further analysis .
The -z statistics compute the summaries. The io,phs shows the protocol hierarchy, the conv,tcp shows the conversations, and the endpoints,ip shows the top talkers. The -q option suppresses the packet output so that only the statistics are printed .
The two-pass analysis (-2) fills in the forward-looking fields. The single-pass analysis cannot compute the fields that depend on the future packets, such as the “response in frame #” and the TCP stream reassembly. The -2 option performs the first pass to parse all the packets and the second pass to fill in the fields .
The live capture uses the -f capture filter, not the -Y display filter. The -Y filter is for the analysis of the captured or the read packets. The live capture with the display filter is slower and may drop the packets under the load .

Remember: tshark is the packet analyzer that reads the pcap files and decodes the application-layer protocols. The -r reads the file, the -Y applies the display filter, and the -T fields -e extracts the fields. The -z computes the statistics, and the -2 performs the two-pass analysis. The display filter uses the Wireshark field syntax, and the capture filter uses the BPF syntax. The result is a tool that answers the question “what is inside the packet” and produces the output that can be scripted, summarized, and shared.

Was this helpful?

Stop using slow, ad-bloated tool sites! 🤮

🔎 Search “KandZ Tools” on Google to use many professional utilities for free.

KandZ.me is the ultimate minimalist hub for:
✅ Finance (Mortgage, Interest, Inflation)
✅ Tech (Base64, JSON, Dev Suite, IP)
✅ Health (BMI, BMR, TDEE)
✅ Productivity (Timer, Workspace, QR)

⚡️ Fast & Private
🔒 No data leaves your device
💎 100% Free

🔗 Use it now: https://tools.kandz.me
🔖 Bookmark it—you’ll need it later!