5 ms·

Wireshark also comes with "tshark" which is a CLI tool that gives you access to display filters and some of the GUI features. In particular, it's great for scri

Wireshark also comes with "tshark" which is a CLI tool that gives you access to display filters and some of the GUI features. In particular, it's great for scripting if you're trying to pull some stats while troubleshooting.

mettamage 11y ago
I never knew, thanks :)
- deleted 11y ago
  [deleted]
s_q_b 11y ago
Tcpdump is cool, tshark is cool, but nothing beats raw libpcap for grabbing raw data off the wire. It is simply so stable at high throughput it's often the only option. Wireshark starts to break down at a certain point. When that happens, I've found scapy (Python pcap parser) very useful. Once that breaks down, a good option reading the hex directly in C. Once that breaks down... Well, there be dragons.
- richardwhiuk 11y ago
  Got to add dpkt to this list for parsing pcap streams - allows you to write some awesome python analysis tools - e.g. For this 5GB packet capture find me all the streams where tcp packets were retransmitted more than twice.
  - s_q_b 11y ago
    Dpkt is also a very good, although I've had some bugs with it on Mac. Probably just odd network issues.
jcbeard 11y ago
If you use VM's for this sort of thing, having images laying around like: https://security-onion-solutions.github.io/security-onion/ https://security-onion-solutions.github.io/security-onion/ gives you most of the tools you'd need (wireshark, scapy, etc. in one place). Seems to be the best way to go for me (Mac laptop user).
theptip 11y ago
I use tshark for capturing a lot, it's great. One of the big advantages for me is that it allows you to use the more expressive (and familiar) wireshark filter syntax, e.g. tshark -i eth0 -Y ip.addr==8.8.8.8 Instead of having to remember tcpdump's own fiddly syntax. Given that most of my protocol debugging work is done inside Wireshark, I'm much more fluent in that filter language. Note that the above snippet is a display filter, so it's capturing all the packets on the wire, doing a full dissection, and then running them through a filter before printing them; if you're trying to capture on a saturated 1G link you might need to fall back to the capture filters which are simpler and faster (and I believe also use tcpdump's syntax).
- SwellJoe 11y ago
  Wireshark syntax is also fiddly. It's just more familiar for some folks. The first several years of my experience troubleshooting network problems happened when Wireshark didn't exist, but tcpdump did. I still have better recollection and comprehension of tcpdump syntax than Wireshark. I have to read the docs to use either these days (since I don't work at that layer of the network much anymore), but I have to read longer to make Wireshark do what I want. Sometimes "ease of use" is really just "what I'm used to". (Not saying Wireshark isn't more expressive or more powerful...it probably is. But, I usually have a very basic use case, and tcpdump can do it with a couple of flags and an address or port.)
knoxa2511 11y ago
Have you used sysdig? https://github.com/draios/sysdig https://github.com/draios/sysdig Its creator was one of the guys behind wireshark. They're pitching sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce. They have csysdig which is similar to tshark

mettamage 11y ago

I never knew, thanks :)

deleted 11y ago
[deleted]

s_q_b 11y ago

Tcpdump is cool, tshark is cool, but nothing beats raw libpcap for grabbing raw data off the wire. It is simply so stable at high throughput it's often the only option. Wireshark starts to break down at a certain point. When that happens, I've found scapy (Python pcap parser) very useful. Once that breaks down, a good option reading the hex directly in C. Once that breaks down... Well, there be dragons.

richardwhiuk 11y ago
Got to add dpkt to this list for parsing pcap streams - allows you to write some awesome python analysis tools - e.g. For this 5GB packet capture find me all the streams where tcp packets were retransmitted more than twice.
- s_q_b 11y ago
  Dpkt is also a very good, although I've had some bugs with it on Mac. Probably just odd network issues.

jcbeard 11y ago

If you use VM's for this sort of thing, having images laying around like: https://security-onion-solutions.github.io/security-onion/ https://security-onion-solutions.github.io/security-onion/ gives you most of the tools you'd need (wireshark, scapy, etc. in one place). Seems to be the best way to go for me (Mac laptop user).

theptip 11y ago

I use tshark for capturing a lot, it's great. One of the big advantages for me is that it allows you to use the more expressive (and familiar) wireshark filter syntax, e.g. tshark -i eth0 -Y ip.addr==8.8.8.8 Instead of having to remember tcpdump's own fiddly syntax. Given that most of my protocol debugging work is done inside Wireshark, I'm much more fluent in that filter language. Note that the above snippet is a display filter, so it's capturing all the packets on the wire, doing a full dissection, and then running them through a filter before printing them; if you're trying to capture on a saturated 1G link you might need to fall back to the capture filters which are simpler and faster (and I believe also use tcpdump's syntax).

SwellJoe 11y ago
Wireshark syntax is also fiddly. It's just more familiar for some folks. The first several years of my experience troubleshooting network problems happened when Wireshark didn't exist, but tcpdump did. I still have better recollection and comprehension of tcpdump syntax than Wireshark. I have to read the docs to use either these days (since I don't work at that layer of the network much anymore), but I have to read longer to make Wireshark do what I want. Sometimes "ease of use" is really just "what I'm used to". (Not saying Wireshark isn't more expressive or more powerful...it probably is. But, I usually have a very basic use case, and tcpdump can do it with a couple of flags and an address or port.)

knoxa2511 11y ago

Have you used sysdig? https://github.com/draios/sysdig https://github.com/draios/sysdig Its creator was one of the guys behind wireshark. They're pitching sysdig as strace + tcpdump + htop + iftop + lsof + ...awesome sauce. They have csysdig which is similar to tshark