This is a static archive of our old Q&A Site. Please post any new questions and answers at

What is the filter to extract TCP packets? (in wireshark)


Anyone knows, please tell me. Your help is highly appreciated.

asked 01 Dec '13, 22:10

Eliza%20Rana's gravatar image

Eliza Rana
accept rate: 0%

edited 01 Dec '13, 22:19

2 Answers:


You can use tshark as following on Linux/OSX:

tshark -R "tcp" -r [path-to-file]

or if your on Windwos and tshark is not in your path open Command Prompt aka CMD:

cd C:\Program Files\Wireshark
tshark.exe -R "tcp" -r [path-to-file]

You can view all options of tshark command with -h:

tshark -h

Let us know.

answered 02 Dec '13, 02:59

Edmond's gravatar image

accept rate: 33%

Thanks for your help, Edmond. I would like to ask you one more question.

Here is my assignment: Plot time-series graph for number of TCP packets per 1 second.

I am plotting this graph using R programming in Windows. And I have to read csv file(that is transformed from pcap file) into R and then plot the time-series graph. In order to plot a graph, there must be 2 values x and y. So I consider x as frame.time. And the y must be the number of TCP packet per 1 second, but I don't know what it is and how to calculate it.

So could you help me please?

(02 Dec '13, 08:30) Eliza Rana


All the info you need for tshark can be found on the man page, or a summary by giving tshark a -h parameter.

For filters, you need to look at Capture Filters and Display Filters. Which one to use depends on your task and environment.

answered 02 Dec '13, 02:52

grahamb's gravatar image

grahamb ♦
accept rate: 22%

edited 02 Dec '13, 02:52