4 tshark - Dump and analyze network traffic
9 S<[ B<-a> E<lt>capture autostop conditionE<gt> ] ...>
10 S<[ B<-b> E<lt>capture ring buffer optionE<gt>] ...>
11 S<[ B<-B> E<lt>capture buffer size (Win32 only)E<gt> ] >
12 S<[ B<-c> E<lt>capture packet countE<gt> ]>
13 S<[ B<-C> E<lt>configuration profileE<gt> ]>
14 S<[ B<-d> E<lt>layer typeE<gt>==E<lt>selectorE<gt>,E<lt>decode-as protocolE<gt> ]>
16 S<[ B<-e> E<lt>fieldE<gt> ]>
17 S<[ B<-E> E<lt>field print optionE<gt> ]>
18 S<[ B<-f> E<lt>capture filterE<gt> ]>
19 S<[ B<-F> E<lt>file formatE<gt> ]>
21 S<[ B<-i> E<lt>capture interfaceE<gt>|- ]>
23 S<[ B<-K> E<lt>keytabE<gt> ]>
27 S<[ B<-N> E<lt>name resolving flagsE<gt> ]>
28 S<[ B<-o> E<lt>preference settingE<gt> ] ...>
31 S<[ B<-r> E<lt>infileE<gt> ]>
32 S<[ B<-R> E<lt>read (display) filterE<gt> ]>
33 S<[ B<-s> E<lt>capture snaplenE<gt> ]>
35 S<[ B<-t> ad|a|r|d|dd|e ]>
36 S<[ B<-T> pdml|psml|ps|text|fields ]>
39 S<[ B<-w> E<lt>outfileE<gt>|- ]>
41 S<[ B<-X> E<lt>eXtension optionE<gt>]>
42 S<[ B<-y> E<lt>capture link typeE<gt> ]>
43 S<[ B<-z> E<lt>statisticsE<gt> ]>
44 S<[ E<lt>capture filterE<gt> ]>
48 B<TShark> is a network protocol analyzer. It lets you capture packet
49 data from a live network, or read packets from a previously saved
50 capture file, either printing a decoded form of those packets to the
51 standard output or writing the packets to a file. B<TShark>'s native
52 capture file format is B<libpcap> format, which is also the format used
53 by B<tcpdump> and various other tools.
55 Without any options set, B<TShark> will work much like B<tcpdump>. It will
56 use the pcap library to capture traffic from the first available network
57 interface and displays a summary line on stdout for each received packet.
59 B<TShark> is able to detect, read and write the same capture files that
60 are supported by B<Wireshark>.
61 The input file doesn't need a specific filename extension; the file
62 format and an optional gzip compression will be automatically detected.
63 Near the beginning of the DESCRIPTION section of wireshark(1) or
64 L<http://www.wireshark.org/docs/man-pages/wireshark.html>
65 is a detailed description of the way B<Wireshark> handles this, which is
66 the same way B<Tshark> handles this.
68 Compressed file support uses (and therefore requires) the zlib library.
69 If the zlib library is not present, B<TShark> will compile, but will
70 be unable to read compressed files.
72 If the B<-w> option is not specified, B<TShark> writes to the standard
73 output the text of a decoded form of the packets it captures or reads.
74 If the B<-w> option is specified, B<TShark> writes to the file
75 specified by that option the raw data of the packets, along with the
78 When writing a decoded form of packets, B<TShark> writes, by
79 default, a summary line containing the fields specified by the
80 preferences file (which are also the fields displayed in the packet list
81 pane in B<Wireshark>), although if it's writing packets as it captures
82 them, rather than writing packets from a saved capture file, it won't
83 show the "frame number" field. If the B<-V> option is specified, it
84 writes instead a view of the details of the packet, showing all the
85 fields of all protocols in the packet.
87 If you want to write the decoded form of packets to a file, run
88 B<TShark> without the B<-w> option, and redirect its standard output to
89 the file (do I<not> use the B<-w> option).
91 When writing packets to a file, B<TShark>, by default, writes the
92 file in B<libpcap> format, and writes all of the packets it sees to the
93 output file. The B<-F> option can be used to specify the format in which
94 to write the file. This list of available file formats is displayed by
95 the B<-F> flag without a value. However, you can't specify a file format
98 Read filters in B<TShark>, which allow you to select which packets
99 are to be decoded or written to a file, are very powerful; more fields
100 are filterable in B<TShark> than in other protocol analyzers, and the
101 syntax you can use to create your filters is richer. As B<TShark>
102 progresses, expect more and more protocol fields to be allowed in read
105 Packet capturing is performed with the pcap library. The capture filter
106 syntax follows the rules of the pcap library. This syntax is different
107 from the read filter syntax. A read filter can also be specified when
108 capturing, and only packets that pass the read filter will be displayed
109 or saved to the output file; note, however, that capture filters are much
110 more efficient than read filters, and it may be more difficult for
111 B<TShark> to keep up with a busy network if a read filter is
112 specified for a live capture.
114 A capture or read filter can either be specified with the B<-f> or B<-R>
115 option, respectively, in which case the entire filter expression must be
116 specified as a single argument (which means that if it contains spaces,
117 it must be quoted), or can be specified with command-line arguments
118 after the option arguments, in which case all the arguments after the
119 filter arguments are treated as a filter expression. Capture filters
120 are supported only when doing a live capture; read filters are supported
121 when doing a live capture and when reading a capture file, but require
122 TShark to do more work when filtering, so you might be more likely to
123 lose packets under heavy load if you're using a read filter. If the
124 filter is specified with command-line arguments after the option
125 arguments, it's a capture filter if a capture is being done (i.e., if no
126 B<-r> option was specified) and a read filter if a capture file is being
127 read (i.e., if a B<-r> option was specified).
133 =item -a E<lt>capture autostop conditionE<gt>
135 Specify a criterion that specifies when B<TShark> is to stop writing
136 to a capture file. The criterion is of the form I<test>B<:>I<value>,
137 where I<test> is one of:
139 B<duration>:I<value> Stop writing to a capture file after I<value> seconds have elapsed.
141 B<filesize>:I<value> Stop writing to a capture file after it reaches a size of I<value>
142 kilobytes (where a kilobyte is 1024 bytes). If this option
143 is used together with the -b option, B<TShark> will stop writing to the
144 current capture file and switch to the next one if filesize is reached. When reading a capture file,
145 B<TShark> will stop reading the file after the number of bytes read exceeds this number
146 (the complete packet will be read, so more bytes than this number may be read).
148 B<files>:I<value> Stop writing to capture files after I<value> number of files were written.
150 =item -b E<lt>capture ring buffer optionE<gt>
152 Cause B<TShark> to run in "multiple files" mode. In "multiple files" mode,
153 B<TShark> will write to several capture files. When the first capture file
154 fills up, B<TShark> will switch writing to the next file and so on.
156 The created filenames are based on the filename given with the B<-w> option,
157 the number of the file and on the creation date and time,
158 e.g. outfile_00001_20050604120117.pcap, outfile_00002_20050604120523.pcap, ...
160 With the I<files> option it's also possible to form a "ring buffer".
161 This will fill up new files until the number of files specified,
162 at which point B<TShark> will discard the data in the first file and start
163 writing to that file and so on. If the I<files> option is not set,
164 new files filled up until one of the capture stop conditions match (or
165 until the disk is full).
167 The criterion is of the form I<key>B<:>I<value>,
168 where I<key> is one of:
170 B<duration>:I<value> switch to the next file after I<value> seconds have
171 elapsed, even if the current file is not completely filled up.
173 B<filesize>:I<value> switch to the next file after it reaches a size of
174 I<value> kilobytes (where a kilobyte is 1024 bytes).
176 B<files>:I<value> begin again with the first file after I<value> number of
177 files were written (form a ring buffer). This option requires either
178 B<duration> or B<filesize> to be specified to control when to go to the next
179 file. It should be noted that each B<-b> parameter takes exactly one criterion;
180 to specify two criterion, each must be preceded by the B<-b> option.
182 =item -B E<lt>capture buffer sizeE<gt> (Win32 only)
184 Win32 only: set capture buffer size (in MB, default is 1MB). This is used by the
185 the capture driver to buffer packet data until that data can be written to
186 disk. If you encounter packet drops while capturing, try to increase this size.
188 =item -c E<lt>capture packet countE<gt>
190 Set the maximum number of packets to read when capturing live
191 data. If reading a capture file, set the maximum number of packets to read.
193 =item -C E<lt>configuration profileE<gt>
195 Run with the given configuration profile.
197 =item -d E<lt>layer typeE<gt>==E<lt>selectorE<gt>,E<lt>decode-as protocolE<gt>
199 Like Wireshark's B<Decode As...> feature, this lets you specify how a
200 layer type should be dissected. If the layer type in question (for example,
201 B<tcp.port> or B<udp.port> for a TCP or UDP port number) has the specified
202 selector value, packets should be dissected as the specified protocol.
204 Example: B<-d tcp.port==8888,http> will decode any traffic running over
205 TCP port 8888 as HTTP.
207 Using an invalid selector or protocol will print out a list of valid selectors
208 and protocol names, respectively.
210 Example: B<-d .> is a quick way to get a list of valid selectors.
212 Example: B<-d ethertype==0x0800.> is a quick way to get a list of protocols that can be
213 selected with an ethertype.
217 Print a list of the interfaces on which B<TShark> can capture, and
218 exit. For each network interface, a number and an
219 interface name, possibly followed by a text description of the
220 interface, is printed. The interface name or the number can be supplied
221 to the B<-i> option to specify an interface on which to capture.
223 This can be useful on systems that don't have a command to list them
224 (e.g., Windows systems, or UNIX systems lacking B<ifconfig -a>);
225 the number can be useful on Windows 2000 and later systems, where the
226 interface name is a somewhat complex string.
228 Note that "can capture" means that B<TShark> was able to open that
229 device to do a live capture. Depending on your system you may need to
230 run tshark from an account with special privileges (for example, as
231 root) to be able to capture network traffic. If B<TShark -D> is not run
232 from such an account, it will not list any interfaces.
234 =item -e E<lt>fieldE<gt>
236 Add a field to the list of fields to display if B<-T fields> is
237 selected. This option can be used multiple times on the command line.
238 At least one field must be provided if the B<-T fields> option is
241 Example: B<-e frame.number -e ip.addr -e udp>
243 Giving a protocol rather than a single field will print multiple items
244 of data about the protocol as a single field. Fields are separated by
245 tab characters by default. B<-E> controls the format of the printed
248 =item -E E<lt>field print optionE<gt>
250 Set an option controlling the printing of fields when B<-T fields> is
255 B<header=y|n> If B<y>, print a list of the field names given using B<-e>
256 as the first line of the output; the field name will be separated using
257 the same character as the field values. Defaults to B<n>.
259 B<separator=/t|/s|>E<lt>characterE<gt> Set the separator character to
260 use for fields. If B</t> tab will be used (this is the default), if
261 B</s>, s single space will be used. Otherwise any character that can be
262 accepted by the command line as part of the option may be used.
264 B<quote=d|s|n> Set the quote character to use to surround fields. B<d>
265 uses double-quotes, B<s> single-quotes, B<n> no quotes (the default).
267 =item -f E<lt>capture filterE<gt>
269 Set the capture filter expression.
271 =item -F E<lt>file formatE<gt>
273 Set the file format of the output capture file written using the B<-w>
274 option. The output written with the B<-w> option is raw packet data, not
275 text, so there is no B<-F> option to request text output. The option B<-F>
276 without a value will list the available formats.
280 Print the version and options and exits.
282 =item -i E<lt>capture interfaceE<gt> | -
284 Set the name of the network interface or pipe to use for live packet
287 Network interface names should match one of the names listed in
288 "B<tshark -D>" (described above); a number, as reported by
289 "B<tshark -D>", can also be used. If you're using UNIX, "B<netstat
290 -i>" or "B<ifconfig -a>" might also work to list interface names,
291 although not all versions of UNIX support the B<-a> option to B<ifconfig>.
293 If no interface is specified, B<TShark> searches the list of
294 interfaces, choosing the first non-loopback interface if there are any
295 non-loopback interfaces, and choosing the first loopback interface if
296 there are no non-loopback interfaces. If there are no interfaces at all,
297 B<TShark> reports an error and doesn't start the capture.
299 Pipe names should be either the name of a FIFO (named pipe) or ``-'' to
300 read data from the standard input. Data read from pipes must be in
301 standard libpcap format.
303 Note: the Win32 version of B<TShark> doesn't support capturing from
308 Put the interface in "monitor mode"; this is supported only on IEEE
309 802.11 Wi-Fi interfaces, and supported only on some operating systems.
311 Note that in monitor mode the adapter might disassociate from the
312 network with which it's associated, so that you will not be able to use
313 any wireless networks with that adapter. This could prevent accessing
314 files on a network server, or resolving host names or network addresses,
315 if you are capturing in monitor mode and are not connected to another
316 network with another adapter.
318 =item -K E<lt>keytabE<gt>
320 Load kerberos crypto keys from the specified keytab file.
321 This option can be used multiple times to load keys from several files.
323 Example: B<-K krb5.keytab>
327 Flush the standard output after the information for each packet is
328 printed. (This is not, strictly speaking, line-buffered if B<-V>
329 was specified; however, it is the same as line-buffered if B<-V> wasn't
330 specified, as only one line is printed for each packet, and, as B<-l> is
331 normally used when piping a live capture to a program or script, so that
332 output for a packet shows up as soon as the packet is seen and
333 dissected, it should work just as well as true line-buffering. We do
334 this as a workaround for a deficiency in the Microsoft Visual C++ C
337 This may be useful when piping the output of B<TShark> to another
338 program, as it means that the program to which the output is piped will
339 see the dissected data for a packet as soon as B<TShark> sees the
340 packet and generates that output, rather than seeing it only when the
341 standard output buffer containing that data fills up.
345 List the data link types supported by the interface and exit. The reported
346 link types can be used for the B<-y> option.
350 Disable network object name resolution (such as hostname, TCP and UDP port
351 names); the B<-N> flag might override this one.
353 =item -N E<lt>name resolving flagsE<gt>
355 Turn on name resolving only for particular types of addresses and port
356 numbers, with name resolving for other types of addresses and port
357 numbers turned off. This flag overrides B<-n> if both B<-N> and B<-n> are
358 present. If both B<-N> and B<-n> flags are not present, all name resolutions are
361 The argument is a string that may contain the letters:
363 B<m> to enable MAC address resolution
365 B<n> to enable network address resolution
367 B<t> to enable transport-layer port number resolution
369 B<C> to enable concurrent (asynchronous) DNS lookups
371 =item -o E<lt>preferenceE<gt>:E<lt>valueE<gt>
373 Set a preference value, overriding the default value and any value read
374 from a preference file. The argument to the option is a string of the
375 form I<prefname>B<:>I<value>, where I<prefname> is the name of the
376 preference (which is the same name that would appear in the preference
377 file), and I<value> is the value to which it should be set.
381 I<Don't> put the interface into promiscuous mode. Note that the
382 interface might be in promiscuous mode for some other reason; hence,
383 B<-p> cannot be used to ensure that the only traffic that is captured is
384 traffic sent to or from the machine on which B<TShark> is running,
385 broadcast traffic, and multicast traffic to addresses received by that
390 When capturing packets, don't display the continuous count of packets
391 captured that is normally shown when saving a capture to a file;
392 instead, just display, at the end of the capture, a count of packets
393 captured. On systems that support the SIGINFO signal, such as various
394 BSDs, you can cause the current count to be displayed by typing your
395 "status" character (typically control-T, although it
396 might be set to "disabled" by default on at least some BSDs, so you'd
397 have to explicitly set it to use it).
399 When reading a capture file, or when capturing and not saving to a file,
400 don't print packet information; this is useful if you're using a B<-z>
401 option to calculate statistics and don't want the packet information
402 printed, just the statistics.
404 =item -r E<lt>infileE<gt>
406 Read packet data from I<infile>, can be any supported capture file format
407 (including gzipped files). It's B<not> possible to use named pipes
410 =item -R E<lt>read (display) filterE<gt>
412 Cause the specified filter (which uses the syntax of read/display filters,
413 rather than that of capture filters) to be applied before printing a
414 decoded form of packets or writing packets to a file; packets not
415 matching the filter are discarded rather than being printed or written.
417 =item -s E<lt>capture snaplenE<gt>
419 Set the default snapshot length to use when capturing live data.
420 No more than I<snaplen> bytes of each network packet will be read into
421 memory, or saved to disk. A value of 0 specifies a snapshot length of
422 65535, so that the full packet is captured; this is the default.
426 Decode and display packets even while writing raw packet data using the
429 =item -t ad|a|r|d|dd|e
431 Set the format of the packet timestamp printed in summary lines.
432 The format can be one of:
434 B<ad> absolute with date: The absolute date and time is the actual time and
435 date the packet was captured
437 B<a> absolute: The absolute time is the actual time the packet was captured,
438 with no date displayed
440 B<r> relative: The relative time is the time elapsed between the first packet
441 and the current packet
443 B<d> delta: The delta time is the time since the previous packet was
446 B<dd> delta_displayed: The delta_displayed time is the time since the
447 previous displayed packet was captured
449 B<e> epoch: The time in seconds since epoch (Jan 1, 1970 00:00:00)
451 The default format is relative.
453 =item -T pdml|psml|ps|text|fields
455 Set the format of the output when viewing decoded packet data. The
458 B<pdml> Packet Details Markup Language, an XML-based format for the details of
459 a decoded packet. This information is equivalent to the packet details
460 printed with the B<-V> flag.
462 B<psml> Packet Summary Markup Language, an XML-based format for the summary
463 information of a decoded packet. This information is equivalent to the
464 information shown in the one-line summary printed by default.
466 B<ps> PostScript for a human-readable one-line summary of each of the packets,
467 or a multi-line view of the details of each of the packets, depending on
468 whether the B<-V> flag was specified.
470 B<text> Text of a human-readable one-line summary of each of the packets, or a
471 multi-line view of the details of each of the packets, depending on
472 whether the B<-V> flag was specified. This is the default.
474 B<fields> The values of fields specified with the B<-e> option, in a
475 form specified by the B<-E> option. For example,
477 -T fields -E separator=, -E quote=d
479 would generate comma-separated values (CSV) output suitable for importing
480 into your favorite spreadsheet program.
485 Print the version and exit.
489 Cause B<TShark> to print a view of the packet details rather
490 than a one-line summary of the packet.
492 =item -w E<lt>outfileE<gt> | -
494 Write raw packet data to I<outfile> or to the standard output if
497 NOTE: -w provides raw packet data, not text. If you want text output
498 you need to redirect stdout (e.g. using '>'), don't use the B<-w>
503 Cause B<TShark> to print a hex and ASCII dump of the packet data
504 after printing the summary or details.
506 =item -X E<lt>eXtension optionsE<gt>
508 Specify an option to be passed to a B<TShark> module. The eXtension option
509 is in the form I<extension_key>B<:>I<value>, where I<extension_key> can be:
511 B<lua_script>:I<lua_script_filename> tells B<Wireshark> to load the given script in addition to the
514 =item -y E<lt>capture link typeE<gt>
516 Set the data link type to use while capturing packets. The values
517 reported by B<-L> are the values that can be used.
519 =item -z E<lt>statisticsE<gt>
521 Get B<TShark> to collect various types of statistics and display the result
522 after finishing reading the capture file. Use the B<-q> flag if you're
523 reading a capture file and only want the statistics printed, not any
524 per-packet information.
526 Note that the B<-z proto> option is different - it doesn't cause
527 statistics to be gathered and printed when the capture is complete, it
528 modifies the regular packet summary output to include the values of
529 fields specified with the option. Therefore you must not use the B<-q>
530 option, as that option would suppress the printing of the regular packet
531 summary output, and must also not use the B<-V> option, as that would
532 cause packet detail information rather than packet summary information
535 Currently implemented statistics are:
539 =item B<-z> dcerpc,rtt,I<uuid>,I<major>.I<minor>[,I<filter>]
541 Collect call/reply RTT data for DCERPC interface I<uuid>,
542 version I<major>.I<minor>.
543 Data collected is the number of calls for each procedure, MinRTT, MaxRTT
546 Example: S<B<-z dcerpc,rtt,12345778-1234-abcd-ef00-0123456789ac,1.0>> will collect data for the CIFS SAMR Interface.
548 If the optional I<filter> is provided, the stats will only be calculated
549 on those calls that match that filter.
551 Example: S<B<-z dcerpc,rtt,12345778-1234-abcd-ef00-0123456789ac,1.0,ip.addr==1.2.3.4>>
552 will collect SAMR RTT statistics for a specific host.
554 This option can be used multiple times on the command line.
556 =item B<-z> io,phs[,I<filter>]
558 Create Protocol Hierarchy Statistics listing both number of packets and bytes.
559 If no I<filter> is specified the statistics will be calculated for all packets.
560 If a I<filter> is specified statistics will be only calculated for those
561 packets that match the filter.
563 This option can be used multiple times on the command line.
565 =item B<-z> io,stat,I<interval>[,I<filter>][,I<filter>][,I<filter>]...
567 Collect packet/bytes statistics for the capture in intervals of
568 I<interval> seconds. I<Interval> can be specified either as a whole or
569 fractional second and can be specified with ms resolution.
570 If I<interval> is 0, the statistics will be calculated over all packets.
572 If no I<filter> is specified the statistics will be calculated for all packets.
573 If one or more I<filters> are specified statistics will be calculated for
574 all filters and presented with one column of statistics for each filter.
576 This option can be used multiple times on the command line.
578 Example: B<-z io,stat,1,ip.addr==1.2.3.4> will generate 1 second
579 statistics for all traffic to/from host 1.2.3.4.
581 Example: B<-z "io,stat,0.001,smb&&ip.addr==1.2.3.4"> will generate 1ms
582 statistics for all SMB packets to/from host 1.2.3.4.
584 The examples above all use the standard syntax for generating statistics
585 which only calculates the number of packets and bytes in each interval.
587 B<io,stat> can also do much more statistics and calculate COUNT(), SUM(),
588 MIN(), MAX(), and AVG() using a slightly different filter syntax:
590 [COUNT|SUM|MIN|MAX|AVG](<field>)<filter>
592 NOTE: One important thing to note here is that the field that the
593 calculation is based on MUST also be part of the filter string or
594 else the calculation will fail.
596 So: B<-z io,stat,0.010,AVG(smb.time)> does not work. Use B<-z
597 io,stat,0.010,AVG(smb.time)smb.time> instead. Also be aware that a field
598 can exist multiple times inside the same packet and will then be counted
599 multiple times in those packets.
601 NOTE: A second important thing to note is that the system setting for
602 decimal separator is set to "."! If it is set to "," the statistics
603 will not be displayed per filter.
605 COUNT(<field>) can be used on any type which has a display filter name.
606 It will count how many times this particular field is encountered in the
607 filtered packet list.
609 Example: B<-z io,stat,0.010,COUNT(smb.sid)smb.sid>
611 This will count the total number of SIDs seen in each 10ms interval.
613 SUM(<field>) can only be used on named fields of integer type.
614 This will sum together every occurence of this fields value for each interval.
616 Example: B<-z io,stat,0.010,SUM(frame.pkt_len)frame.pkt_len>
618 This will report the total number of bytes seen in all the packets within
621 MIN/MAX/AVG(<field>) can only be used on named fields that are either
622 integers or relative time fields. This will calculate maximum/minimum
623 or average seen in each interval. If the field is a relative time field
624 the output will be presented in seconds and three digits after the
625 decimal point. The resolution for time calculations is 1ms and anything
626 smaller will be truncated.
628 Example: B<-z "io,stat,0.010,smb.time&&ip.addr==1.1.1.1,MIN(smb.time)smb.time&&ip.addr==1.1.1.1,MAX(smb.time)smb.time&&ip.addr==1.1.1.1,MAX(smb.time)smb.time&&ip.addr==1.1.1.1">
630 This will calculate statistics for all smb response times we see to/from
631 host 1.1.1.1 in 10ms intervals. The output will be displayed in 4
632 columns; number of packets/bytes, minimum response time, maximum response
633 time and average response time.
635 =item B<-z> conv,I<type>[,I<filter>]
637 Create a table that lists all conversations that could be seen in the
638 capture. I<type> specifies the conversation endpoint types for which we
639 want to generate the statistics; currently the supported ones are:
641 "eth" Ethernet addresses
642 "fc" Fibre Channel addresses
643 "fddi" FDDI addresses
645 "ipv6" IPv6 addresses
647 "tcp" TCP/IP socket pairs Both IPv4 and IPv6 are supported
648 "tr" Token Ring addresses
649 "udp" UDP/IP socket pairs Both IPv4 and IPv6 are supported
651 If the optional I<filter> is specified, only those packets that match the
652 filter will be used in the calculations.
654 The table is presented with one line for each conversation and displays
655 the number of packets/bytes in each direction as well as the total
656 number of packets/bytes. The table is sorted according to the total
659 =item B<-z> proto,colinfo,I<filter>,I<field>
661 Append all I<field> values for the packet to the Info column of the
662 one-line summary output.
663 This feature can be used to append arbitrary fields to the Info column
664 in addition to the normal content of that column.
665 I<field> is the display-filter name of a field which value should be placed
667 I<filter> is a filterstring that controls for which packets the field value
668 will be presented in the info column. I<field> will only be presented in the
669 Info column for the packets which match I<filter>.
671 NOTE: In order for B<TShark> to be able to extract the I<field> value
672 from the packet, I<field> MUST be part of the I<filter> string. If not,
673 B<TShark> will not be able to extract its value.
675 For a simple example to add the "nfs.fh.hash" field to the Info column
676 for all packets containing the "nfs.fh.hash" field, use
678 B<-z proto,colinfo,nfs.fh.hash,nfs.fh.hash>
680 To put "nfs.fh.hash" in the Info column but only for packets coming from
683 B<-z "proto,colinfo,nfs.fh.hash && ip.src==1.2.3.4,nfs.fh.hash">
685 This option can be used multiple times on the command line.
687 =item B<-z> diameter,avp[,I<cmd.code>,I<field>,I<field>,I<...>]
689 This option enables extraction of most important diameter fields from large capture files.
690 Exactly one text line for each diameter message with matched B<diameter.cmd.code> will be printed.
692 Empty diameter command code or '*' can be specified to mach any B<diameter.cmd.code>
694 Example: B<-z diameter,avp> extract default field set from diameter messages.
696 Example: B<-z diameter,avp,280> extract default field set from diameter DWR messages.
698 Example: B<-z diameter,avp,272> extract default field set from diameter CC messages.
700 Extract most important fields from diameter CC messages:
702 B<tshark -r file.cap.gz -q -z diameter,avp,272,CC-Request-Type,CC-Request-Number,Session-Id,Subscription-Id-Data,Rating-Group,Result-Code>
704 Following fields will be printed out for each diameter message:
706 "frame" Frame number.
707 "time" Unix time of the frame arrival.
708 "src" Source address.
709 "srcport" Source port.
710 "dst" Destination address.
711 "dstport" Destination port.
712 "proto" Constant string 'diameter', which can be used for post processing of tshark output. e.g. grep/sed/awk.
713 "msgnr" seq. number of diameter message within the frame. E.g. '2' for the third diameter message in the same frame.
714 "is_request" '0' if message is a request, '1' if message is an answer.
715 "cmd" diameter.cmd_code, E.g. '272' for credit control messages.
716 "req_frame" Number of frame where matched request was found or '0'.
717 "ans_frame" Number of frame where matched answer was found or '0'.
718 "resp_time" response time in seconds, '0' in case if matched Request/Answer is not found in trace. E.g. in the begin or end of capture.
720 B<-z diameter,avp> option is much faster than B<-V -T text> or B<-T pdml> options.
722 B<-z diameter,avp> option is more powerful than B<-T field> and B<-z proto,colinfo> options.
724 Multiple diameter messages in one frame are supported.
726 Several fields with same name within one diameter message are supported, e.g. I<diameter.Subscription-Id-Data> or I<diameter.Rating-Group>.
728 Note: B<tshark -q> option is recommended to suppress default B<tshark> output.
730 =item B<-z> rpc,rtt,I<program>,I<version>[,I<filter>]
732 Collect call/reply RTT data for I<program>/I<version>. Data collected
733 is number of calls for each procedure, MinRTT, MaxRTT and AvgRTT.
734 Example: B<-z rpc,rtt,100003,3> will collect data for NFS v3.
736 If the optional I<filter> is provided, the stats will only be calculated
737 on those calls that match that filter.
739 Example: B<-z rpc,rtt,100003,3,nfs.fh.hash==0x12345678> will collect NFS v3
740 RTT statistics for a specific file.
742 This option can be used multiple times on the command line.
744 =item B<-z> rpc,programs
746 Collect call/reply RTT data for all known ONC-RPC programs/versions.
747 Data collected is number of calls for each protocol/version, MinRTT,
749 This option can only be used once on the command line.
751 =item B<-z> rtp,streams
753 Collect statistics for all RTP streams and calculate max. delta, max. and
754 mean jitter and packet loss percentages.
756 =item B<-z> smb,rtt[,I<filter>]
758 Collect call/reply RTT data for SMB. Data collected
759 is number of calls for each SMB command, MinRTT, MaxRTT and AvgRTT.
760 Example: B<-z smb,rtt>.
761 The data will be presented as separate tables for all normal SMB commands,
762 all Transaction2 commands and all NT Transaction commands.
763 Only those commands that are seen in the capture will have its stats
765 Only the first command in a xAndX command chain will be used in the
766 calculation. So for common SessionSetupAndX + TreeConnectAndX chains,
767 only the SessionSetupAndX call will be used in the statistics.
768 This is a flaw that might be fixed in the future.
770 This option can be used multiple times on the command line.
772 If the optional I<filter> is provided, the stats will only be calculated
773 on those calls that match that filter.
775 Example: B<-z "smb,rtt,ip.addr==1.2.3.4"> will only collect stats for
776 SMB packets echanged by the host at IP address 1.2.3.4 .
780 When this feature is used B<TShark> will print a report with all the
781 discovered SID and account name mappings. Only those SIDs where the
782 account name is known will be presented in the table.
784 For this feature to work you will need to either to enable
785 "Edit/Preferences/Protocols/SMB/Snoop SID to name mappings" in the
786 preferences or you can override the preferences by specifying
787 S<B<-o "smb.sid_name_snooping:TRUE">> on the B<TShark> command line.
789 The current method used by B<TShark> to find the SID->name mapping
790 is relatively restricted with a hope of future expansion.
792 =item B<-z> mgcp,rtd[I<,filter>]
794 Collect requests/response RTD (Response Time Delay) data for MGCP.
795 (This is similar to B<-z smb,rtt>). Data collected is the number of calls
796 for each known MGCP Type, MinRTD, MaxRTD and AvgRTD.
797 Additionally you get the number of duplicate requests/responses,
798 unresponded requests, responses ,which don't match with
800 Example: B<-z mgcp,rtd>.
802 This option can be used multiple times on the command line.
804 If the optional I<filter> is provided, the stats will only be calculated
805 on those calls that match that filter.
806 Example: B<-z "mgcp,rtd,ip.addr==1.2.3.4"> will only collect stats for
807 MGCP packets exchanged by the host at IP address 1.2.3.4 .
809 =item B<-z> megaco,rtd[I<,filter>]
811 Collect requests/response RTD (Response Time Delay) data for MEGACO.
812 (This is similar to B<-z smb,rtt>). Data collected is the number of calls
813 for each known MEGACO Type, MinRTD, MaxRTD and AvgRTD.
814 Additionally you get the number of duplicate requests/responses,
815 unresponded requests, responses ,which don't match with
817 Example: B<-z megaco,rtd>.
819 If the optional I<filter> is provided, the stats will only be calculated
820 on those calls that match that filter.
821 Example: B<-z "megaco,rtd,ip.addr==1.2.3.4"> will only collect stats for
822 MEGACO packets exchanged by the host at IP address 1.2.3.4 .
824 This option can be used multiple times on the command line.
826 =item B<-z> h225,counter[I<,filter>]
828 Count ITU-T H.225 messages and their reasons. In the first column you get a
829 list of H.225 messages and H.225 message reasons, which occur in the current
830 capture file. The number of occurences of each message or reason is displayed
831 in the second column.
833 Example: B<-z h225,counter>.
835 If the optional I<filter> is provided, the stats will only be calculated
836 on those calls that match that filter.
837 Example: use B<-z "h225,counter,ip.addr==1.2.3.4"> to only collect stats for
838 H.225 packets exchanged by the host at IP address 1.2.3.4 .
840 This option can be used multiple times on the command line.
842 =item B<-z> h225,srt[I<,filter>]
844 Collect requests/response SRT (Service Response Time) data for ITU-T H.225 RAS.
845 Data collected is number of calls of each ITU-T H.225 RAS Message Type,
846 Minimum SRT, Maximum SRT, Average SRT, Minimum in Frame, and Maximum in Frame.
847 You will also get the number of Open Requests (Unresponded Requests),
848 Discarded Responses (Responses without matching request) and Duplicate Messages.
849 Example: B<-z h225,srt>.
851 If the optional I<filter> is provided, the stats will only be calculated
852 on those calls that match that filter.
853 Example: B<-z "h225,srt,ip.addr==1.2.3.4"> will only collect stats for
854 ITU-T H.225 RAS packets exchanged by the host at IP address 1.2.3.4 .
856 This option can be used multiple times on the command line.
858 =item B<-z> sip,stat[I<,filter>]
860 This option will activate a counter for SIP messages. You will get the number
861 of occurences of each SIP Method and of each SIP Status-Code. Additionally you
862 also get the number of resent SIP Messages (only for SIP over UDP).
864 Example: B<-z sip,stat>.
866 This option can be used multiple times on the command line.
868 If the optional I<filter> is provided, the stats will only be calculated
869 on those calls that match that filter.
870 Example: B<-z "sip,stat,ip.addr==1.2.3.4"> will only collect stats for
871 SIP packets exchanged by the host at IP address 1.2.3.4 .
877 =head1 CAPTURE FILTER SYNTAX
879 See the manual page of pcap-filter(4) or, if that doesn't exist, tcpdump(8),
880 or, if that doesn't exist, L<http://wiki.wireshark.org/CaptureFilters>.
882 =head1 READ FILTER SYNTAX
884 For a complete table of protocol and protocol fields that are filterable
885 in B<TShark> see the wireshark-filter(4) manual page.
889 These files contains various B<Wireshark> configuration values.
895 The F<preferences> files contain global (system-wide) and personal
896 preference settings. If the system-wide preference file exists, it is
897 read first, overriding the default settings. If the personal preferences
898 file exists, it is read next, overriding any previous values. Note: If
899 the command line option B<-o> is used (possibly more than once), it will
900 in turn override values from the preferences files.
902 The preferences settings are in the form I<prefname>B<:>I<value>,
904 where I<prefname> is the name of the preference
905 and I<value> is the value to
906 which it should be set; white space is allowed between B<:> and
907 I<value>. A preference setting can be continued on subsequent lines by
908 indenting the continuation lines with white space. A B<#> character
909 starts a comment that runs to the end of the line:
911 # Capture in promiscuous mode?
912 # TRUE or FALSE (case-insensitive).
913 capture.prom_mode: TRUE
915 The global preferences file is looked for in the F<wireshark> directory
916 under the F<share> subdirectory of the main installation directory (for
917 example, F</usr/local/share/wireshark/preferences>) on UNIX-compatible
918 systems, and in the main installation directory (for example,
919 F<C:\Program Files\Wireshark\preferences>) on Windows systems.
921 The personal preferences file is looked for in
922 F<$HOME/.wireshark/preferences> on
923 UNIX-compatible systems and F<%APPDATA%\Wireshark\preferences> (or, if
924 %APPDATA% isn't defined, F<%USERPROFILE%\Application
925 Data\Wireshark\preferences>) on Windows systems.
927 =item Disabled (Enabled) Protocols
929 The F<disabled_protos> files contain system-wide and personal lists of
930 protocols that have been disabled, so that their dissectors are never
931 called. The files contain protocol names, one per line, where the
932 protocol name is the same name that would be used in a display filter
938 The global F<disabled_protos> file uses the same directory as the global
941 The personal F<disabled_protos> file uses the same directory as the
942 personal preferences file.
944 =item Name Resolution (hosts)
946 If the personal F<hosts> file exists, it is
947 used to resolve IPv4 and IPv6 addresses before any other
948 attempts are made to resolve them. The file has the standard F<hosts>
949 file syntax; each line contains one IP address and name, separated by
950 whitespace. The same directory as for the personal preferences file is
953 Capture filter name resolution is handled by libpcap on UNIX-compatible
954 systems and WinPCAP on Windows. As such the Wireshark personal F<hosts> file
955 will not be consulted for capture filter name resolution.
957 =item Name Resolution (ethers)
959 The F<ethers> files are consulted to correlate 6-byte hardware addresses to
960 names. First the personal F<ethers> file is tried and if an address is not
961 found there the global F<ethers> file is tried next.
963 Each line contains one hardware address and name, separated by
964 whitespace. The digits of the hardware address are separated by colons
965 (:), dashes (-) or periods (.). The same separator character must be
966 used consistently in an address. The following three lines are valid
967 lines of an F<ethers> file:
969 ff:ff:ff:ff:ff:ff Broadcast
970 c0-00-ff-ff-ff-ff TR_broadcast
971 00.00.00.00.00.00 Zero_broadcast
973 The global F<ethers> file is looked for in the F</etc> directory on
974 UNIX-compatible systems, and in the main installation directory (for
975 example, F<C:\Program Files\Wireshark>) on Windows systems.
977 The personal F<ethers> file is looked for in the same directory as the personal
980 Capture filter name resolution is handled by libpcap on UNIX-compatible
981 systems and WinPCAP on Windows. As such the Wireshark personal F<ethers> file
982 will not be consulted for capture filter name resolution.
984 =item Name Resolution (manuf)
986 The F<manuf> file is used to match the 3-byte vendor portion of a 6-byte
987 hardware address with the manufacturer's name; it can also contain well-known
988 MAC addresses and address ranges specified with a netmask. The format of the
989 file is the same as the F<ethers> files, except that entries of the form:
993 can be provided, with the 3-byte OUI and the name for a vendor, and
996 00-00-0C-07-AC/40 All-HSRP-routers
998 can be specified, with a MAC address and a mask indicating how many bits
999 of the address must match. The above entry, for example, has 40
1000 significant bits, or 5 bytes, and would match addresses from
1001 00-00-0C-07-AC-00 through 00-00-0C-07-AC-FF. The mask need not be a
1004 The F<manuf> file is looked for in the same directory as the global
1007 =item Name Resolution (ipxnets)
1009 The F<ipxnets> files are used to correlate 4-byte IPX network numbers to
1010 names. First the global F<ipxnets> file is tried and if that address is not
1011 found there the personal one is tried next.
1013 The format is the same as the F<ethers>
1014 file, except that each address is four bytes instead of six.
1015 Additionally, the address can be represented as a single hexadecimal
1016 number, as is more common in the IPX world, rather than four hex octets.
1017 For example, these four lines are valid lines of an F<ipxnets> file:
1021 00:00:BE:EF IT_Server1
1024 The global F<ipxnets> file is looked for in the F</etc> directory on
1025 UNIX-compatible systems, and in the main installation directory (for
1026 example, F<C:\Program Files\Wireshark>) on Windows systems.
1028 The personal F<ipxnets> file is looked for in the same directory as the
1029 personal preferences file.
1033 =head1 ENVIRONMENT VARIABLES
1037 =item WIRESHARK_DEBUG_EP_NO_CHUNKS
1039 Normally per-packet memory is allocated in large "chunks." This behavior
1040 doesn't work well with debugging tools such as Valgrind or ElectricFence.
1041 Export this environment variable to force individual allocations.
1042 Note: disabling chunks also disables canaries (see below).
1044 =item WIRESHARK_DEBUG_SE_NO_CHUNKS
1046 Normally per-file memory is allocated in large "chunks." This behavior
1047 doesn't work well with debugging tools such as Valgrind or ElectricFence.
1048 Export this environment variable to force individual allocations.
1049 Note: disabling chunks also disables canaries (see below).
1051 =item WIRESHARK_DEBUG_EP_NO_CANARY
1053 Normally per-packet memory allocations are separated by "canaries" which
1054 allow detection of memory overruns. This comes at the expense of some extra
1055 memory usage. Exporting this environment variable disables these canaries.
1057 =item WIRESHARK_DEBUG_SE_USE_CANARY
1059 Exporting this environment variable causes per-file memory allocations to be
1060 protected with "canaries" which allow for detection of memory overruns.
1061 This comes at the expense of significant extra memory usage.
1063 =item WIRESHARK_DEBUG_SCRUB_MEMORY
1065 If this environment variable is exported, the contents of per-packet and
1066 per-file memory is initialized to 0xBADDCAFE when the memory is allocated
1067 and is reset to 0xDEADBEEF when the memory is freed. This functionality is
1068 useful mainly to developers looking for bugs in the way memory is handled.
1070 =item WIRESHARK_RUN_FROM_BUILD_DIRECTORY
1072 This environment variable causes the plugins and other data files to be loaded
1073 from the build directory (where the program was compiled) rather than from the
1074 standard locations. It has no effect when the program in question is running
1075 with root (or setuid) permissions on *NIX.
1077 =item WIRESHARK_DATA_DIR
1079 This environment variable causes the various data files to be loaded from
1080 a directory other than the standard locations. It has no effect when the
1081 program in question is running with root (or setuid) permissions on *NIX.
1083 =item WIRESHARK_PYTHON_DIR
1085 This environment variable points to an alternate location for Python.
1086 It has no effect when the program in question is running with root (or setuid)
1087 permissions on *NIX.
1089 =item ERF_RECORDS_TO_CHECK
1091 This environment variable controls the number of ERF records checked when
1092 deciding if a file really is in the ERF format. Setting this environment
1093 variable a number higher than the default (20) would make false positives
1096 =item WIRESHARK_ABORT_ON_DISSECTOR_BUG
1098 If this environment variable is set, B<TShark> will call abort(3)
1099 when a dissector bug is encountered. abort(3) will cause the program to
1100 exit abnormally; if you are running B<TShark> in a debugger, it
1101 should halt in the debugger and allow inspection of the process, and, if
1102 you are not running it in a debugger, it will, on some OSes, assuming
1103 your environment is configured correctly, generate a core dump file.
1104 This can be useful to developers attempting to troubleshoot a problem
1105 with a protocol dissector.
1111 wireshark-filter(4), wireshark(1), editcap(1), pcap-filter(4), tcpdump(8),
1112 pcap(3), dumpcap(1), text2pcap(1), mergecap(1)
1116 B<TShark> is part of the B<Wireshark> distribution. The latest version
1117 of B<Wireshark> can be found at L<http://www.wireshark.org>.
1119 HTML versions of the Wireshark project man pages are available at:
1120 L<http://www.wireshark.org/docs/man-pages>.
1124 B<TShark> uses the same packet dissection code that B<Wireshark> does,
1125 as well as using many other modules from B<Wireshark>; see the list of
1126 authors in the B<Wireshark> man page for a list of authors of that code.