Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I know that WireShark allows live packet capturing as well as details being displayable in the GUI. Is there any similar program that operates on a CLI, rather than a GUI? This is intended for use on a server install, in which only CLI is available (and also where disk space is limited, so much that the dependencies for the wireshark packages cannot be installed (i.e. the packages for the GUI).

share|improve this question

2 Answers 2

up vote 10 down vote accepted

Sure, tshark (text shark) is the same program, but with a noninteractive command line interface.

You can also run tshark on the server and transfer the captures over ssh to a wireshark gui running somewhere else.

For example:

  mbp@joy% sudo tshark -i wlan0 -p  -R 'http'
  Capturing on wlan0
  3.929359 192.168.178.22 -> 66.102.11.104 HTTP GET / HTTP/1.1 
  4.104763 66.102.11.104 -> 192.168.178.22 HTTP HTTP/1.1 301 Moved Permanently  (text/html)
  4.118925 192.168.178.22 -> 66.102.11.104 HTTP GET / HTTP/1.1 
  4.295749 66.102.11.104 -> 192.168.178.22 HTTP HTTP/1.1 302 Found  (text/html)
  4.355713 192.168.178.22 -> 66.102.11.104 HTTP GET / HTTP/1.1 
  4.560568 66.102.11.104 -> 192.168.178.22 HTTP HTTP/1.1 200 OK  (text/html)
  4.588767 192.168.178.22 -> 66.102.11.104 HTTP GET /images/nav_logo40.png HTTP/1.1 

You can also do tshark ... |tee packetlog so it goes both to the screen and to the file.

Or, alternatively, tshark -w stuff.pcap will write the raw packets into that file, which you can then copy to another machine and open within the wireshark gui, if you want to do more in-depth investigation.

share|improve this answer
1  
Could I also do something like sudo tshark -i wlan0 -p -R 'http' > packetlogs.txt or something similar in terminal, so that it logs everything to a file, and perhaps run this command in a screen session or something? I'd hate to do a tcpdump, because that would be a PITA after a while. –  Thomas W. Apr 4 '11 at 0:46
1  
FOR THE RECORD... I tested tshark for about an hour, and compared the output with the output from wireshark. It shows exactly what I need (the complete packet analysis) in tshark's output, esp. in the file i had the output go to. Works for me now, it'll be an awesome CLI alternative to wireshark in this manner :) –  Thomas W. Apr 4 '11 at 3:24

tshark Install tshark is a good option.

An alternative is tcpdump Install tcpdump, which is a well-known predecessor. It's widely available on other platforms, so you might run into it even if you don't use it on your server.

share|improve this answer
    
yeah, i have issues with tcpdump (basically with it being a PITA because it just doesnt like to work well on my system :/) –  Thomas W. Apr 4 '11 at 3:22
    
@EvilP Then tshark might be the way to go. I use tcpdump primarily on systems where it's available and wireshark/tshark isn't. I usually end up pulling the captures back into the wireshark GUI, anyway. –  belacqua Apr 4 '11 at 4:32

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.