Take the 2-minute tour ×

I know that WireShark allows live packet capturing as well as details being displayable in the GUI. Is there any similar program that operates on a CLI, rather than a GUI? This is intended for use on a server install, in which only CLI is available (and also where disk space is limited, so much that the dependencies for the wireshark packages cannot be installed (i.e. the packages for the GUI).

share|improve this question
add comment

2 Answers

up vote 10 down vote accepted

Sure, tshark (text shark) is the same program, but with a noninteractive command line interface.

You can also run tshark on the server and transfer the captures over ssh to a wireshark gui running somewhere else.

For example:

  mbp@joy% sudo tshark -i wlan0 -p  -R 'http'
  Capturing on wlan0
  3.929359 -> HTTP GET / HTTP/1.1 
  4.104763 -> HTTP HTTP/1.1 301 Moved Permanently  (text/html)
  4.118925 -> HTTP GET / HTTP/1.1 
  4.295749 -> HTTP HTTP/1.1 302 Found  (text/html)
  4.355713 -> HTTP GET / HTTP/1.1 
  4.560568 -> HTTP HTTP/1.1 200 OK  (text/html)
  4.588767 -> HTTP GET /images/nav_logo40.png HTTP/1.1 

You can also do tshark ... |tee packetlog so it goes both to the screen and to the file.

Or, alternatively, tshark -w stuff.pcap will write the raw packets into that file, which you can then copy to another machine and open within the wireshark gui, if you want to do more in-depth investigation.

share|improve this answer
Could I also do something like sudo tshark -i wlan0 -p -R 'http' > packetlogs.txt or something similar in terminal, so that it logs everything to a file, and perhaps run this command in a screen session or something? I'd hate to do a tcpdump, because that would be a PITA after a while. –  Thomas W. Apr 4 '11 at 0:46
FOR THE RECORD... I tested tshark for about an hour, and compared the output with the output from wireshark. It shows exactly what I need (the complete packet analysis) in tshark's output, esp. in the file i had the output go to. Works for me now, it'll be an awesome CLI alternative to wireshark in this manner :) –  Thomas W. Apr 4 '11 at 3:24
add comment

tshark Install tshark is a good option.

An alternative is tcpdump Install tcpdump, which is a well-known predecessor. It's widely available on other platforms, so you might run into it even if you don't use it on your server.

share|improve this answer
yeah, i have issues with tcpdump (basically with it being a PITA because it just doesnt like to work well on my system :/) –  Thomas W. Apr 4 '11 at 3:22
@EvilP Then tshark might be the way to go. I use tcpdump primarily on systems where it's available and wireshark/tshark isn't. I usually end up pulling the captures back into the wireshark GUI, anyway. –  belacqua Apr 4 '11 at 4:32
add comment

Your Answer


