This is our old Q&A Site. Please post any new questions and answers at

Hi all,

I am using tshark to sniff HTTP content on a very busy server and I see that the CPU usage of the tshark process is very high.

This is the command line I am using:

tshark.exe -i3 -l -f "tcp port 80" -O http -d tcp.port==80,http -o "ip.use_geoip:FALSE" -R "not tcp.analysis.duplicate_ack" -T fields -e -e tcp.port -e http.request.full_uri -e http.request.method -e http.response.code -e http.response.phrase -e http.content_length -e data -e text -E separator=;2>&0

Is there anything I can do to get the same result - but with better performance? Can anyone point to any part of the command line that might be the reason for the high CPU usage?



asked 04 Mar '13, 11:34

David%20Sackstein's gravatar image

David Sackstein
accept rate: 0%

Wow, this is some tshark command line. I assume you need the -l because you pipe the output to another tool or script? I think you can leave out the -O http bit, since you later on as for specific fields using -T. I also think you can leave out the -d tcp.port==80,http bit, it's rather obvious tcp port 80 traffic is HTTP, at least that's what the HTTP dissector assumes. I'm not sure these would improve performance though. I recon taking out the -R filter would.

permanent link

answered 04 Mar '13, 15:00

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Is there anything I can do to get the same result - but with better performance?

please try this:

tshark.exe -n -i3

instead of

tshark.exe -i3


permanent link

answered 05 Mar '13, 12:26

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

Hi Kurt, Thanks for this tip. Is the order of the options actually important too? Must -n be before -i3? Thanks David

(05 Mar '13, 12:41) David Sackstein

The order does not matter.

(05 Mar '13, 12:48) Kurt Knochner ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 04 Mar '13, 11:34

question was seen: 3,204 times

last updated: 05 Mar '13, 12:48

p​o​w​e​r​e​d by O​S​Q​A