Scrolling through the packets in the terminal won’t always give out information to understand what’s causing the issue. So why not save the captured packets to a file? For example, your SSH connection has been working fine, and suddenly the connection is not available. But perhaps you don’t have time to troubleshoot at the moment. Viewing captured packets in real-time lets you immediately act for troubleshooting. This command updates your system’s list of packages and their current versions.Ĭapturing Packets using Display Filter Saving Captured Packets to a File Run the apt update command below to ensure your package manager is up to date. Related: Learning Ubuntu Apt Get Through Examplesġ. But for this demo, you’ll install using the APT package manager. Using your package manager, you can install on most Linux distributions and BSD operating systems. TShark doesn’t come installed on your Linux distro by default, so before you can take advantage of this, kick off this tutorial by installing TShark on your machine.

A Linux machine – This tutorial uses Ubuntu 20.04 LTS, but any Linux distributions will work.

If you’d like to follow along, be sure you have the following. This tutorial will be a hands-on demonstration. Read on and never waste hours analyzing your packet captures again! Prerequisites One thing that makes this great is that instead of clicking multiple buttons and digging through various menus, you can type just one command to get the information you need. TShark is the equivalent of Wireshark GUI, which provides valuable information about traffic captured in your network. One way to optimize packet capture is to use a command-line interface tool, and out of all the tools you can find, TShark is one you must try.

Tshark port filter