--- title: 'Wireshark for CLI' url: 'https://kb.hills-family.uk/blog/wireshark-for-cli' markdown: 'https://kb.hills-family.uk/blog/wireshark-for-cli.md' date: '2021-05-13' description: 'Wireshark is a really useful tool to record and analyse network traffic across any network interface. I use it when faulting embedded applications in order to conduct a sanity check that data is leaving or arriving correctly. I recently wanted to use Wireshark on a remote computer — a task that would normally be quite easy to do — but in this instance, there was no remote desktop as such and, instead, was purely CLI-based. Fortunately, Wireshark has a CLI alternative, t' taxonomy: tag: - Linux - Network - Wireshark --- # Wireshark for CLI [ Home ](https://kb.hills-family.uk/) [ Blog ](https://kb.hills-family.uk/blog) Wireshark for CLI 13 *May* #### [Wireshark for CLI](https://kb.hills-family.uk/blog/wireshark-for-cli) [Linux](https://kb.hills-family.uk/blog/tag:Linux) [Network](https://kb.hills-family.uk/blog/tag:Network) [Wireshark](https://kb.hills-family.uk/blog/tag:Wireshark) [Wireshark](https://www.wireshark.org/) is a really useful tool to record and analyse network traffic across any network interface. I use it when faulting embedded applications in order to conduct a sanity check that data is leaving or arriving correctly. I recently wanted to use Wireshark on a remote computer — a task that would normally be quite easy to do — but in this instance, there was no remote desktop as such and, instead, was purely CLI-based. Fortunately, Wireshark has a CLI alternative, [`tshark`](https://www.wireshark.org/docs/man-pages/tshark.html) that can pretty much do everything Wireshark can, minus the GUI. `tshark` is available for most Linux distros (e.g. via `apt install tshark` for Debian-based installs) so is quite convenient. Unfortunately, there’s a “bug” when running `tshark` under `sudo` that causes `tshark` to think it doesn’t have the correct priviledges (despite running under `root`) to write an output file. For example: ```bash sudo tshark -i enp0s25 -w filename.pcap ``` will tend to fail. The fix? Pipe the output of `tshark`, such as: ```bash sudo tshark -i enp0s25 -w - > filename.pcap ``` [ Next Post](https://kb.hills-family.uk/blog/hopping-with-ssh) [Previous Post ](https://kb.hills-family.uk/blog/when-you-dont-have-curl) #### Knowledge Base Tips, tricks and how-to guides on various topics. #### Popular Tags [Linux](https://kb.hills-family.uk/blog/tag:Linux) [Dynamics AX](https://kb.hills-family.uk/blog/tag:Dynamics%20AX) [D365 Finance and Operations](https://kb.hills-family.uk/blog/tag:D365%20Finance%20and%20Operations) [Network](https://kb.hills-family.uk/blog/tag:Network) [Data Management Framework](https://kb.hills-family.uk/blog/tag:Data%20Management%20Framework) [Logic Apps](https://kb.hills-family.uk/blog/tag:Logic%20Apps) [JavaScript](https://kb.hills-family.uk/blog/tag:JavaScript) [netcat](https://kb.hills-family.uk/blog/tag:netcat) [SSH](https://kb.hills-family.uk/blog/tag:SSH) [PowerShell](https://kb.hills-family.uk/blog/tag:PowerShell) [Virtual Machines](https://kb.hills-family.uk/blog/tag:Virtual%20Machines) [VMware](https://kb.hills-family.uk/blog/tag:VMware) [SQL Server](https://kb.hills-family.uk/blog/tag:SQL%20Server) [Wireshark](https://kb.hills-family.uk/blog/tag:Wireshark) [Python](https://kb.hills-family.uk/blog/tag:Python) [Licensing](https://kb.hills-family.uk/blog/tag:Licensing) [Ubuntu](https://kb.hills-family.uk/blog/tag:Ubuntu) --- ## Navigation - Parent: [Blog](https://kb.hills-family.uk/blog.md) - Previous: [Hopping with SSH](https://kb.hills-family.uk/blog/hopping-with-ssh.md) - Next: [When you don't have curl...](https://kb.hills-family.uk/blog/when-you-dont-have-curl.md)