3 ms·

Some Linux distros (Debian family) separate tshark from wrireshark which is great because that means you can install tshark without X-Windowsetc... I wish the o

Some Linux distros (Debian family) separate tshark from wrireshark which is great because that means you can install tshark without X-Windowsetc... I wish the other predominant distro family (Fedora) did the same. I have not used tcpdump a lot, but I believe there is nothing it can do that tshark cannot. Tshark can capture only the portion of traffic you want via filters, which can reduce the size of your pcap files considerably, and possibly haves less of an impact on performance. When using tshark, make sure you capture the traffics to a file too, so you can go back to look at something that happened x seconds or minutes ago. I understand the security concerns, but forms being able to debug with tshark (or an equivalent tool) is a very good reason for not using HTTPS internally.

rmc 11y ago
> I understand the security concerns, but forms being able to debug with tshark (or an equivalent tool) is a very good reason for not using HTTPS internally. One of the nice things about HTTPS is that it's just a SSL connection and the HTTP goes over it. It's not hard to use socat to create something which listens to TCP connections on one port, and wraps it in a SSL layer and sends that on to another host:port. This allows you to remove the S from HTTPS, and you then speak HTTP to it, and hence can use tcpdump (etc) to dump.
dfc 11y ago
> I have not used tcpdump a lot, but I believe there is nothing it can do that tshark cannot. How about go two months without a security vulnerability in packet processing logic? Drop slightly fewer packets? (Yes, dumpcap too) > good reason for not using HTTPS internally. Nevermind.