TShark
What it is
TShark is the Wireshark project’s terminal-mode utility for capturing and examining network traffic. It can capture packets from a live network or read saved capture files, decode packet data, and write captures to a file. Its native capture format is pcapng, and it can read and write formats supported by Wireshark. Display filters use the same syntax as Wireshark to select packets or protocol fields. Output options include fields, JSON, PDML, and text. Capture settings include interface selection, capture filters, packet limits, and ring-buffer files. TShark can also write ElasticSearch mapping data or pipe packet output to another program or script. One constraint is that display filters are unavailable when capturing and saving packets with the -w option. The manual gives a 2 TB maximum capture-file size and notes possible issues above 2^32 packets. TShark is free under GNU GPL version 2 and is available for Linux, macOS, and Windows.
For and against
For
- Captures live traffic or reads saved captures
- Offers fields, JSON, PDML, and text output
- Includes capture filters and ring-buffer files
- Can pipe output to programs or scripts
Against
- Display filters are unavailable with capture and -w saving
- Capture files have a stated 2 TB maximum
- Manual notes possible issues above 2^32 packets
The verdict
TShark offers packet capture and protocol analysis in a terminal utility, with multiple output formats and capture controls. Users should account for its display-filter limitation during capture-to-file workflows and the manual’s file-size caveats.
Who it suits
TShark suits users who want command-line tools to capture or analyze network traffic, filter protocol data, or pass packet output to scripts. It is available on Linux, macOS, and Windows.
Plans and prices
Free
GNU GPL v2 · network protocol analyzer
Read 30 Sep 2026 · wireshark.org
On the record
- Analysis limit
- Display filters are not supported when TShark captures and saves packets with the -w option.wireshark.org · read 30 Sep 2026
- Capture controls
- Capture options include interface selection, capture filters, packet limits, and ring-buffer files.wireshark.org · read 30 Sep 2026
- File size limit
- The manual states that capture file size is limited to a maximum of 2 TB, and notes potential issues above 2^32 packets.wireshark.org · read 30 Sep 2026
- Integration
- TShark can write ElasticSearch mapping data and supports piping packet output to another program or script.wireshark.org · read 30 Sep 2026
- License
- Wireshark is freely available under the GNU General Public License version 2, with no license fee for downloading.wireshark.org · read 30 Sep 2026
- Maker
- The Wireshark project is maintained by the Wireshark Foundation, described as a nonprofit supported by donations.wireshark.org · read 30 Sep 2026
- Output
- TShark can output packet data in formats including fields, JSON, PDML, and text.wireshark.org · read 30 Sep 2026
- Packet formats
- TShark uses pcapng as its native capture format and can read and write capture files supported by Wireshark.wireshark.org · read 30 Sep 2026
- Project features
- The Wireshark project describes TShark as its terminal-mode utility and lists live capture, offline analysis, protocol inspection, and display filters among its features.wireshark.org · read 30 Sep 2026
- Protocol analysis
- TShark provides display filters for selecting packets and protocol fields, using the same syntax as Wireshark.wireshark.org · read 30 Sep 2026
- Purpose
- TShark captures live network traffic or reads saved captures, then decodes packets for output or writes them to a file.wireshark.org · read 30 Sep 2026
- Security information
- The documentation page links to security advisories covering past vulnerabilities and how to report a vulnerability.wireshark.org · read 30 Sep 2026
- Support and learning
- The project offers documentation, mailing lists, community forums, and educational resources including SharkFest.wireshark.org · read 30 Sep 2026
- Supported systems
- The project lists Windows, Linux, macOS, FreeBSD, NetBSD, and other platforms as supported by Wireshark.wireshark.org · read 30 Sep 2026
