You can use the ifconfig -a command to view all network interfaces on a system. I am using my WiFi card to connect to my home router for accessing the internet. My laptop (which I am using for these examples) shows: ~]$ sudo tshark -D To identify what network devices are available to TShark, run the following command. Begin by identifying the NIC or WiFi card used to connect to the internet. Network packets are processed via a network interface card (NIC) on servers, workstations, or desktops or a WiFi card on laptops. Find network devices available to TSharkīefore TShark can analyze packets, it needs to capture those packets. Root users can skip sudo and directly run the tshark command. If you are logged in as a regular, non-root user, you need sudo rights to use the TShark utility. If the Wireshark package is installed, check whether the TShark utility is installed and, if so, which version: ~]$ tshark -vīuilt using gcc 9.0.1 20190312 (Red Hat ~]$ ~]$ cat /etc/fedora-releaseįedora release 30 ~]$ Check your installationįirst, ensure the required packages are installed: ~]$ rpm -qa | grep -i ~]$ Also, I am using Fedora for these examples. For any changes to TShark's command-line options or flags, please refer to the appropriate man pages and online documentation. To try the examples in this article, you need to be connected to the internet. However, it also provides a powerful command-line utility called TShark for people who prefer to work on the Linux command line. Wireshark is a popular open source graphical user interface (GUI) tool for analyzing packets.

To understand these protocols, you need a tool that can capture and help you analyze these packets. Right now, while you are reading this article, numerous packets are being exchanged by your computer and traveling across the internet. Most of the time when we connect to the internet, we don't think about the network protocols at work underneath that make it all possible.

Tshark read pcap