Opening a capture with tshark

Packets on disk

A packet capture (.pcap) is a recording of raw network traffic. tshark is the command-line Wireshark; -r reads a file and prints one summary line per packet:

tshark -r /srv/soc-data/network/capture.pcap

In the terminal

student@vulntech:~$ tshark -r /srv/soc-data/network/capture.pcap
    1   0.000000 203.0.113.66 → 10.10.10.5   TCP 54 40000 → 21 [SYN] Seq=0 Win=1024 Len=0
    2   0.000001 203.0.113.66 → 10.10.10.5   TCP 54 40001 → 22 [SYN] Seq=0 Win=1024 Len=0
    3   0.000002 203.0.113.66 → 10.10.10.5   TCP 54 40002 → 23 [SYN] Seq=0 Win=1024 Len=0
    4   0.000003 203.0.113.66 → 10.10.10.5   TCP 54 40003 → 25 [SYN] Seq=0 Win=1024 Len=0
    5   0.000004 203.0.113.66 → 10.10.10.5   TCP 54 40004 → 80 [SYN] Seq=0 Win=1024 Len=0
    6   0.000005 203.0.113.66 → 10.10.10.5   TCP 54 40005 → 110 [SYN] Seq=0 Win=1024 Len=0
    7   0.000006 203.0.113.66 → 10.10.10.5   TCP 54 40006 → 139 [SYN] Seq=0 Win=1024 Len=0
    8   0.000007 203.0.113.66 → 10.10.10.5   TCP 54 40007 → 143 [SYN] Seq=0 Win=1024 Len=0
    9   0.000008 203.0.113.66 → 10.10.10.5   TCP 54 40008 → 443 [SYN] Seq=0 Win=1024 Len=0
   10   0.000009 203.0.113.66 → 10.10.10.5   TCP 54 40009 → 445 [SYN] Seq=0 Win=1024 Len=0
   11   0.000010 203.0.113.66 → 10.10.10.5   TCP 54 40010 → 3306 [SYN] Seq=0 Win=1024 Len=0
   12   0.000011 203.0.113.66 → 10.10.10.5   TCP 54 40011 → 3389 [SYN] Seq=0 Win=1024 Len=0
   13   0.000012 203.0.113.66 → 10.10.10.5   TCP 54 40012 → 5900 [SYN] Seq=0 Win=1024 Len=0
   14   0.000013 203.0.113.66 → 10.10.10.5   TCP 54 40013 → 8080 [SYN] Seq=0 Win=1024 Len=0
   15   0.000014 203.0.113.66 → 10.10.10.5   TCP 54 40014 → 8443 [SYN] Seq=0 Win=1024 Len=0
   16  90.000000   10.10.10.5 → 10.10.10.1   DNS 80 Standard query 0x1234 A sync-updates-cdn.net

Count them to size up the capture (one line per packet):

tshark -r /srv/soc-data/network/capture.pcap | wc -l

In the terminal

student@vulntech:~$ tshark -r /srv/soc-data/network/capture.pcap | wc -l
16

Tip: tshark reads a saved file with -r — it is not sniffing live traffic, so you can replay the same evidence as often as you like.