How to Capture Packets with TShark: Command-Line Wireshark Examples for Consistent, Scriptable Captures

Before I get into the tshark command syntax and other details, I want to chat about why you want to use tshark or any command line tool. Simply put, working from the command line allows a tremendous amount of consistency and flexibility.

Consistency

When you try to have someone perform your capture using the Wireshark GUI, there are many opportunities for errors and its just very time consuming. When you have the command line syntax figured out, you can put it in an email, batch file or document ensuring the client is doing exactly what you wanted. The added bonus is that working from, the command line is usually more responsive that remotely controlling a GUI over possibly slow links.

Diagnosing MTU Black Holes: Using Ping and Wireshark to Find Fragmentation Issues on a WAN (John Modlin)

I was working at a large network heterogeneous environment and started working on a problem of scanners at field offices being unable to transfer documents across the WAN. Working on this problem led me quite down the rabbit hole, a black hole to be more specific.


The field techs had already changed out scanners, but the site continued to be intermittently unable to send documents across the WAN. Some documents transferred, some didn’t. After checking permissions and general settings on the scanner, I started looking at the network path.

Wireshark Tips: How to Hide Unused Network Interfaces and Clear Your Recent File List

 Networkdatapedia.com has been asking for material that focus on knowing your network and/or knowing your tools.

Sounds pretty simple but trust me this is anything but simple or obvious. When you use the same tool and it becomes your ‘favorite’ or ‘go to tool’ you might be resistant to trying new tools.

How to Determine ARP Refresh Rate Using Wireshark (Windows 8/10 Guide)

 

There have been more than a few times where I had to illustrate that ARP was an issue.

When a suspected ARP issue, or you just need to understand how often a device ARP’s, or you need a good challenge when using your favorite packet analyzer, this is a great exercise.

Troubleshooting DNS Client Configuration Issues: How to Spot Bad DNS Servers in a Packet Trace

In this video I wanted to show you an issue that I encounter quite often that is not specifically related to DNS. DNS is one of those protocols we all take for granted and most people believe that if its working, and no one is complaining, go find something else to do.

There are many things you can do to improve DNS performance. One of the more common techniques is to configure a device as a local DNS server, cache or relay for those scenarios where you might have slow/high latency internet connections.