Introduction
In this lab, you will explore tshark, the powerful command-line counterpart to Wireshark. While Wireshark provides a graphical interface for network analysis, tshark allows you to perform the exact same packet capture and analysis directly from the terminal.
This matters because packet analysis usually happens at two different levels. Tools like tcpdump are excellent at showing raw packet summaries and applying low-level capture filters before packets are stored. tshark goes a step further by decoding protocol structure after capture. That means it understands fields such as HTTP methods, DNS query names, and many other protocol-specific details. In practice, analysts often use both styles: low-level capture to collect evidence efficiently, and protocol-aware analysis to ask richer questions later.
You will learn how to capture live network traffic, save it to a file, and apply display filters that inherently understand protocol structures (like HTTP and DNS). These display filters are far more capable than standard Berkeley Packet Filters (BPF) because they can dissect the contents of the packets. Finally, you will learn how to generate protocol hierarchy statistics to get a high-level overview of your network traffic.
Perform Basic Capture
In this step, you will learn how to capture live network traffic using tshark and save it to a file for later analysis.
Before we start capturing, we need to ensure there is some network traffic happening on your system. A background script is already running in your environment, continuously generating DNS and HTTP traffic.
At this stage, it is useful to separate capturing from analyzing. Capturing is the act of preserving packets exactly as they cross an interface. Analysis is what happens afterward when you decode and interpret those packets. Security investigations often begin by capturing broadly because you may not yet know what matters. Once the packets are preserved in a PCAP file, you can re-read them many times and ask different questions without needing the original traffic to happen again.
Now, let's capture the network traffic. We will use tshark to listen on all available network interfaces (any) and save the captured packets to a file named traffic.pcap. We will also tell tshark to automatically stop capturing after 5 seconds.
Execute the following commands to start the capture and save the file correctly:
sudo tshark -i any -w /tmp/traffic.pcap -a duration:5
sudo mv /tmp/traffic.pcap ~/project/traffic.pcap
sudo chown labex:labex ~/project/traffic.pcap
Let's break down the options used in the tshark command:
sudo: Runs the command with administrative privileges, which is required to capture network traffic.-i any: Specifies thattsharkshould capture traffic on all available network interfaces.-w /tmp/traffic.pcap: Tellstsharkto temporarily write the captured raw packet data to a file in the/tmpdirectory. This is a best practice to avoid permissions issues when runningtsharkas root.-a duration:5: Sets an autostop condition (-a) to stop the capture after a duration of 5 seconds.
You will see an output similar to this, indicating that packets are being captured:
Capturing on 'eth0'
24
Once the 5 seconds have passed, tshark will automatically exit, and your traffic.pcap file will be ready for analysis.
Apply Display Filters
In this step, you will learn how to read the packet capture file you just created and apply display filters to isolate specific types of traffic.
Display filters in tshark (and Wireshark) are incredibly powerful because they understand the structure of network protocols. Instead of just looking at IP addresses or port numbers, you can filter traffic based on protocol names like http or dns.
That distinction is worth emphasizing. A classic capture filter asks low-level questions such as "does this packet use port 53?" A display filter can ask higher-level questions such as "is this packet a DNS response?" or "does this HTTP request have a specific field?" In other words, display filters work after protocol dissection, which is why they feel more expressive and easier to read.
To read a capture file instead of capturing live traffic, you use the -r option. To apply a display filter, you use the -Y option followed by the filter string.
First, let's filter the capture file to show only HTTP traffic. Run the following command:
tshark -r ~/project/traffic.pcap -Y "http"
You should see output similar to this, showing only the HTTP GET request and the corresponding HTTP OK response:
4 0.012345678 10.0.2.15 → 93.184.216.34 HTTP 143 GET / HTTP/1.1
8 0.045678901 93.184.216.34 → 10.0.2.15 HTTP 403 HTTP/1.1 200 OK (text/html)
Next, let's filter the capture file to show only DNS traffic. DNS (Domain Name System) is the protocol used to translate domain names like example.com into IP addresses.
Run the following command to apply the DNS display filter:
tshark -r ~/project/traffic.pcap -Y "dns"
The output will display the DNS queries and responses that occurred during your capture window:
1 0.000000000 10.0.2.15 → 10.0.2.3 DNS 73 Standard query 0x1a2b A example.com
2 0.001234567 10.0.2.3 → 10.0.2.15 DNS 89 Standard query response 0x1a2b A example.com A 93.184.216.34
By using the -Y option, you can easily sift through thousands of packets to find exactly what you are looking for.
View Protocol Hierarchy Statistics
In this step, you will learn how to generate a statistical overview of the protocols present in your capture file.
When analyzing a large capture file, it is often helpful to get a high-level summary of what kind of traffic is inside before diving into individual packets. tshark provides a feature called "Protocol Hierarchy Statistics" which calculates the percentage and number of packets for each protocol.
This top-down view is a common investigative technique. Before spending time on individual packets, analysts often ask broad questions first: What protocols dominate this capture? Is the traffic mostly web, name resolution, or something unusual? Do the proportions match the system's expected role? That high-level context helps you decide where deeper inspection is worth the effort.
To generate statistics, you use the -z option followed by the specific statistic you want to calculate. For Protocol Hierarchy Statistics, the keyword is io,phs.
Additionally, because we only want to see the statistics report and not the individual packet details, we will use the -q (quiet) option.
Run the following command to view the protocol hierarchy of your capture file:
tshark -r ~/project/traffic.pcap -q -z io,phs
You will see a tree-like output summarizing the traffic:
===================================================================
Protocol Hierarchy Statistics
Filter:
eth frames:24 bytes:2340
ipv4 frames:24 bytes:2340
udp frames:2 bytes:162
dns frames:2 bytes:162
tcp frames:12 bytes:1338
http frames:2 bytes:546
icmp frames:10 bytes:840
===================================================================
This output tells you exactly how many frames (packets) and bytes belong to each protocol. For example, you can see the Ethernet (eth) layer contains IPv4 traffic, which is further broken down into UDP (containing DNS), TCP (containing HTTP), and ICMP (the ping traffic we generated).
This statistical view is an excellent starting point for any network troubleshooting or security analysis task.
Summary
Congratulations! You have successfully completed the Introduction to Tshark lab.
In this lab, you learned how to:
- Capture live network traffic and save it to a
.pcapfile usingtshark. - Read a capture file and apply protocol-aware display filters to isolate HTTP and DNS traffic.
- Generate and analyze Protocol Hierarchy Statistics to get a high-level overview of network activity.
These fundamental skills form the basis of command-line network analysis and troubleshooting in Linux environments.
