generate pcap wireshark statistics from command line

Remember that in the Wireshark family that the dumpcap utility used alone is the least lossy and least resource intensive tool to capture with. If the goal is to troubleshoot and trace out individual conversations keep in mind the loss rate that might be involved and consider filters: if there is a need to capture much more than a fraction of a 1GbE or 10GbE, then a hardware capture tool may be necessary to avoid significant capture loss. When capturing data in bulk to profile conversations you may not care if you lose a small percentage of packets.

An advantage of tshark lies in its quick ability to glean out statistics and save the data to csv files. Data Analysis platforms such as R and Pandas can be helpful as well Packet Capture files are usually viewed and manipulated with the Wireshark GUI, but one can also use tshark–the command line utility that is part of Wireshark.

Examining raw capture data in terms of PCAP files can be facilitated with the help of a few common and freely available tools. Understanding network traffic flows is a multifaceted subject involving potentially many different tools and utilities.

Generate pcap wireshark statistics from command line