Read Packet Data in Tshark

Introduction

In this lab, you will learn how to use Wireshark's command-line tool tshark to analyze network packet captures. You'll practice essential commands like -r for reading capture files, -V for verbose output, and -c for packet count limitation while working with a sample PCAP file.

Through hands-on exercises, you'll examine packet headers, identify key network details including IP addresses and protocols, and interpret different output formats. This lab provides practical experience with tshark's core functionalities for effective network traffic analysis.

Skills Graph

Open File with -r capture.pcap

In this step, we'll explore how to analyze pre-recorded network traffic using Wireshark's powerful command-line tool tshark. When working with network analysis, we often need to examine previously captured data rather than capturing live traffic. The -r flag (which stands for "read") allows us to do exactly that by specifying a packet capture file to analyze.

Before we begin, let's make sure we're working in the right location. In terminal-based work, it's crucial to be in the correct directory where our files are stored:

cd ~/project

The LabEx environment comes with tshark pre-installed, which is the command-line version of Wireshark. To confirm it's available and check which version we're using (good practice when working with any tool), run:

tshark --version

You should see detailed version information appear, confirming that tshark is properly installed and ready to use.

For this demonstration, we'll work with a sample network capture file. It's already downloaded to /home/labex/project/capture.pcap.

Now we're ready to examine the captured network traffic. The basic command to read and display the contents of our capture file is:

tshark -r capture.pcap

This command processes the file and displays a summary view of all captured packets. Each line in the output represents one network packet and includes several important pieces of information that help us understand the network activity:

• Packet number: The sequential identifier of each packet
• Timestamp: When the packet was captured (relative to start of capture)
• Source IP: Where the packet came from
• Destination IP: Where the packet was going
• Protocol: The network protocol being used (TCP, UDP, etc.)
• Length: The size of the packet in bytes
• Info: A brief description of the packet's purpose or content

Here's what typical output might look like, showing a TCP connection being established:

1 0.000000 192.168.1.1 → 192.168.1.2 TCP 66 443 → 49234 [SYN] Seq=0 Win=64240 Len=0
2 0.000123 192.168.1.2 → 192.168.1.1 TCP 66 49234 → 443 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0

This initial view gives us a high-level overview of the network communication contained in our capture file, which we'll build upon in subsequent steps.

Display Packet Summary with Default Output

In this step, we'll explore how to read and understand the basic packet summary that tshark displays by default. This is your starting point for analyzing network traffic, showing essential information about each packet in a structured format.

Before we begin, let's make sure we're in the right working directory where our capture file is stored:

cd ~/project

The default output from tshark presents network traffic in columns that each tell us something important about the communication:

1. Packet number: The sequential identifier of each packet in the capture
2. Timestamp: When the packet was captured, relative to the first packet
3. Source address: Where the packet came from (IP address)
4. Destination address: Where the packet is going (IP address)
5. Protocol: The network protocol being used (TCP, UDP, etc.)
6. Length: How big the packet is in bytes
7. Info: Additional details specific to the protocol

Let's look at the first 5 packets to see this in action:

tshark -r capture.pcap -c 5

Example output:

    1 0.000000 192.168.1.1 → 192.168.1.2 TCP 66 443 → 49234 [SYN] Seq=0 Win=64240 Len=0
    2 0.000123 192.168.1.2 → 192.168.1.1 TCP 66 49234 → 443 [SYN, ACK] Seq=0 Ack=1 Win=65535 Len=0
    3 0.000145 192.168.1.1 → 192.168.1.2 TCP 54 443 → 49234 [ACK] Seq=1 Ack=1 Win=64240 Len=0
    4 0.000567 192.168.1.1 → 192.168.1.2 TLSv1 583 Client Hello
    5 0.000789 192.168.1.2 → 192.168.1.1 TCP 54 49234 → 443 [ACK] Seq=1 Ack=530 Win=65535 Len=0

To get a broader understanding of what's happening in our network capture, we can count how many packets belong to each protocol type. This helps identify which protocols are most active in our network traffic:

tshark -r capture.pcap -qz io,phs

This command generates a protocol hierarchy table, showing the distribution of different protocols in your capture file, which is particularly useful when analyzing complex network traffic patterns.

Show Detailed Fields with -V

In this step, we'll explore how to view comprehensive packet details using Wireshark's -V (verbose) flag. This is particularly useful when you need to examine all protocol layers and their fields within a network packet.

Before we begin, let's make sure we're in the right working directory where our packet capture file is stored:

cd ~/project

The -V flag reveals the complete structure of each packet, showing all protocol layers from the physical frame up to the application data. This hierarchical view helps you understand how different protocols work together in network communication. Let's look at the first packet in our capture file:

tshark -r capture.pcap -V -c 1

The output will display detailed information about each protocol layer. Here's an example of what you might see (shortened for clarity):

Frame 1: 66 bytes on wire (528 bits), 66 bytes captured (528 bits)
    Encapsulation type: Ethernet (1)
    Arrival Time: Jun  8, 2023 10:15:32.000000000 UTC
    [Time shift for this packet: 0.000000000 seconds]
    Epoch Time: 1686219332.000000000 seconds
    [Time delta from previous captured frame: 0.000000000 seconds]
    [Time delta from previous displayed frame: 0.000000000 seconds]
    [Time since reference or first frame: 0.000000000 seconds]
    Frame Number: 1
    Frame Length: 66 bytes (528 bits)
    Capture Length: 66 bytes (528 bits)
    [Frame is marked: False]
    [Frame is ignored: False]
    [Protocols in frame: eth:ethertype:ip:tcp]
Ethernet II, Src: 00:11:22:33:44:55, Dst: aa:bb:cc:dd:ee:ff
    Destination: aa:bb:cc:dd:ee:ff
    Source: 00:11:22:33:44:55
    Type: IPv4 (0x0800)
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 192.168.1.2
    Version: 4
    Header length: 20 bytes
    ...

If you only want to see details for packets containing a specific protocol (like TCP), you can combine -V with the -Y display filter. This helps focus your analysis on particular network traffic:

tshark -r capture.pcap -V -Y "tcp" -c 1

Count Packets with -c 100

In this step, we'll explore how to control packet display in Tshark using the -c flag. This is particularly useful when working with large capture files where you only need to analyze a sample of packets.

First, let's navigate to our working directory where the packet capture file is stored. This ensures all commands will work with the correct file:

cd ~/project

The -c flag (short for "count") limits how many packets Tshark will process and display. For example, to examine just the first 100 packets from our capture file:

tshark -r capture.pcap -c 100

When analyzing specific types of traffic, we can combine the -c flag with a display filter using -Y. This command shows the first 100 HTTP packets:

tshark -r capture.pcap -Y "http" -c 100

If you need to know the total number of packets in the file (not just the first 100), this pipeline counts all lines in the output:

tshark -r capture.pcap | wc -l

For a more detailed breakdown of protocols in your capture, this command provides a protocol hierarchy summary showing counts for each protocol type:

tshark -r capture.pcap -qz io,phs

Summary

In this lab, you have learned to utilize Wireshark's command-line tool tshark for analyzing network packet captures. The exercises covered opening PCAP files with the -r flag, verifying installation via --version, and examining default output fields including packet metadata and protocol information.

You have also practiced interpreting the structured packet summary format and using the -c flag to control output volume. These skills provide a solid foundation for efficient network traffic analysis and protocol investigation using saved capture files.