Displaying network traffic using tshark

There are many tools for troubleshooting networks, each with its own strengths. This article introduces a useful tool for analyzing a machine’s traffic: tshark. TShark is a network protocol analyzer (Wireshark in text mode) that captures packets from the network in real time, making network analysis easier. With no options specified, its output resembles tcpdump. Why use tshark? It can decode more protocols than tcpdump, allowing faster packet analysis. Install tshark

[root@Ezylinux ~]# yum install wireshark

tshark usage examples Sniff HTTP requests

[root@Ezylinux ~]# tshark 'tcp port 80 and (((ip[2:2] - ((ip[0]&0xf)<<2)) - ((tcp[12]&0xf0)>>2)) != 0)' -R 'http.request.method == "GET" || http.request.method == "HEAD"'

Sniff HTTP request headers

[root@Ezylinux ~]# tshark tcp port 80 or tcp port 443 -V -R "http.request"

Sniff HTTP response headers

[root@Ezylinux ~]# tshark tcp port 80 or tcp port 443 -V -R "http.response"