tshark equivalent of Wireshark commands

Is there an equivalent command line in tshark that does the following.

Filters the packet to TCP only (tcp.port==5555)
Follow TCP stream.
Save the file as raw.

The process will enable us to view real time video stream via TCP.

capture-filter tshark wireshark

asked 09 May '16, 22:25

Dr Dre
6●2●2●3
accept rate: 0%

One Answer:

active answers oldest answers newest answers popular answers

tshark -i eth0 -z "follow,tcp,raw,1" "tcp port 5555" would come close, but still requires you to process the text output into a raw file. Better option would be to consult the tools section of the wiki. Here you may find tools more suitable for your purpose.

permanent link

answered 10 May '16, 01:28

Jaap ♦
11.7k●16●101
accept rate: 14%

Jaap,

Thanks for that. I have seen this command before. I thought I was just getting the syntax wrong. So I tried it again yesterday. When I use the command above wireshark, I get a notification saying that z follow is not an option.

Dre Dre.

(11 May '16, 17:13) Dr Dre

@Dr Dre, because it's a command line option to tshark, not to Wireshark?

(11 May '16, 22:28) Jaap ♦

Sorrt Jaap, just clarifying. I did use this via tshark.

(11 May '16, 22:53) Dr Dre

What tshark version are we talking about here? I think it was already in by version 1.8.

(12 May '16, 02:58) Jaap ♦

Jaap,

I just checked, the version I have on my Ubuntu is 1.6.7.

Dre Dre

(18 May '16, 18:08) Dr Dre

I just changed the version of wireshark/tshark and the z follow command works. Having issues then with saving it to a file.

(18 May '16, 19:49) Dr Dre

showing 5 of 6 show 1 more comments

Your answer

toggle preview

community wiki:

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

*italic* or _italic_
**bold** or __bold__
link:[text](http://url.com/ "title")
image?![alt text](/path/img.jpg "title")
numbered list: 1. Foo 2. Bar
to add a line break simply add two spaces to where you would like the new line to be.
basic HTML tags are also supported

learn more about Markdown

Question tags:

wireshark ×1,620
tshark ×832
capture-filter ×184

question asked: 09 May '16, 22:25

question was seen: 1,575 times

last updated: 18 May '16, 19:49

tshark equivalent of Wireshark commands

Follow this question

You have a trillion packets.

You need to see four of them.

Don't have Wireshark?

Related questions