Anthropic-Cybersecurity-Skills/skills/analyzing-network-traffic-with-wireshark/references/api-reference.md

API Reference: Wireshark and tshark

Live Capture

tshark -i eth0                              # Capture on interface
tshark -i eth0 -w output.pcap              # Write to file
tshark -i eth0 -a duration:60              # Capture for 60 seconds
tshark -i eth0 -f "port 80"               # BPF capture filter
tshark -D                                   # List interfaces

Display Filters (Read Mode)

tshark -r capture.pcap -Y "<filter>"

Common Filters

Filter	Purpose
ip.addr == 10.0.0.5	Traffic to/from IP
tcp.port == 443	Traffic on port 443
http.request	HTTP requests only
dns.qr == 0	DNS queries only
tls.handshake.type == 1	TLS Client Hello
tcp.flags.syn == 1 && tcp.flags.ack == 0	SYN-only
frame.len > 1500	Large frames
tcp.analysis.retransmission	Retransmissions
icmp	ICMP traffic

Field Extraction

tshark -r capture.pcap -T fields \
  -e frame.time -e ip.src -e ip.dst -e tcp.dstport \
  -E separator="," -E header=y

Common Fields

Field	Description
frame.time	Packet timestamp
ip.src / ip.dst	Source/destination IP
tcp.srcport / tcp.dstport	TCP ports
http.request.method	HTTP method
http.host	HTTP Host header
http.request.uri	Request URI
http.user_agent	User-Agent
dns.qry.name	DNS query name
tls.handshake.extensions_server_name	TLS SNI
tls.handshake.ja3	JA3 fingerprint

Statistics

tshark -r capture.pcap -q -z conv,ip         # IP conversations
tshark -r capture.pcap -q -z endpoints,ip    # IP endpoints
tshark -r capture.pcap -q -z io,stat,60      # I/O per minute
tshark -r capture.pcap -q -z io,phs          # Protocol hierarchy
tshark -r capture.pcap -q -z http,tree       # HTTP stats
tshark -r capture.pcap -q -z dns,tree        # DNS stats
tshark -r capture.pcap -q -z expert          # Expert info

Object Export

tshark -r capture.pcap --export-objects "http,/output/dir"
tshark -r capture.pcap --export-objects "smb,/output/dir"
tshark -r capture.pcap --export-objects "tftp,/output/dir"
tshark -r capture.pcap --export-objects "imf,/output/dir"

Stream Following

tshark -r capture.pcap -z follow,tcp,ascii,0
tshark -r capture.pcap -z follow,http,ascii,0
tshark -r capture.pcap -z follow,tls,ascii,0

Wireshark GUI Shortcuts

Shortcut	Action
Ctrl+F	Find packet
Ctrl+G	Go to packet
Ctrl+Shift+E	Export objects
Ctrl+H	Follow stream

editcap - PCAP Manipulation

editcap -A "2024-01-15 09:00" -B "2024-01-15 10:00" in.pcap out.pcap  # Time filter
editcap -c 1000 large.pcap split.pcap    # Split into 1000-packet files
editcap -F pcap in.pcapng out.pcap       # Convert format

mergecap - Merge PCAPs

mergecap -w merged.pcap file1.pcap file2.pcap