Awesome! I always wanted a command-line alternative to wireshark. I learned abou...

MichaelGG · on Feb 28, 2014

Command-line alternative to wireshark is tshark. tshark is much more capable, since you can use all the well-made Wireshark protocol dissectors.

tacoman · on Feb 28, 2014

tshark also has a fabulous ring buffer feature that lets you run captures continuously while chunking the files up into manageable sizes.

e.g. -b filesize:100000 -b files:200 -w somefile

This will make a ring buffer of 200 * 100MB files.

After typing this, I realized this may have limited use cases, but I use it almost every day.

sgrossman · on March 1, 2014

If you are on a system that doesn't have tshark, tcpdump provides the same functionality via the -C <file_size_in_MB> -W <num_files> flags.

e.g. -C 100 -W 200 -w somefile will get you the same circular ring of 200 100MB files.

Also, don't forget to add the -s 0 flag if you want to get the entire payload.

scott_karana · on Feb 28, 2014

It's a great ad-hoc solution for monitoring types of traffic. I've used it too. :-)