01 · Product name
TShark
Wireshark's reader, in the terminal.
Published by Wireshark Foundation.
In short
TShark is the terminal reader shipped with Wireshark. On 18 Oct 2026 the command tshark --version printed TShark (Wireshark) 4.2.2. Against Wireshark's sample http2_follow_multistream.pcapng, a display filter on the TLS server-name field printed www.mozilla.org. The conversation statistic for that file showed one TCP conversation, 197 frames and 232 kB, between 10.9.0.2 port 59246 and 104.16.40.2 port 443, lasting 182.8 seconds. The SPDX field on the Wireshark mirror is GPL-2.0. A printed name is the field in the file, not an identification.
Product pricing strategy
02
Free
TShark is part of the Wireshark distribution. The download page does not price it separately, and it does not print a price for Wireshark. The SPDX field is GPL-2.0. The 4.2.2 binary used here came from Ubuntu's package. There is no TShark seat or credit on the pages opened for this listing. If a commercial support offer bundles the CLI, cite that offer. Otherwise write GPL-2.0 and the version the binary printed. The server-name field and the conversation table came from that same free package.
Utility and features
03
TShark uses the same dissectors as Wireshark and prints them to the terminal. The version line from this host was TShark (Wireshark) 4.2.2, Git v4.2.2 packaged as 4.2.2-1.1build3. The file was the project's http2_follow_multistream.pcapng. The field extraction for tls.handshake.extensions_server_name returned one value, www.mozilla.org. The conversation table reported 92 frames and 222 kB one way and 105 frames and 9,383 bytes the other, 197 frames and 232 kB in total.
- Version line. tshark --version printed TShark (Wireshark) 4.2.2 from the Ubuntu package.
- One SNI. The server-name field extraction printed www.mozilla.org.
- 197 frames. The TCP conversation table showed 197 frames, 232 kB, over 182.8 seconds, to port 443.
The download page's stable Wireshark release the same day was 4.6.9. TShark's version follows the Wireshark package you installed, so a script that assumes 4.6.9 fields on a 4.2.2 binary is wrong. Quote the line the binary printed. tcpdump will print the same packets with less protocol detail. Wireshark will show the same frames in a window. TShark is the one you put in a pipeline. The sample addresses are the file's, from a public test capture, not this host.
- 1
Print the version, then the field you mean, and keep both in the note.
- 2
Use a conversation or IO statistic when you need a count.
- 3
Match the filter to the binary version, not to the upstream stable label.
Caveats
04
A display filter that prints one server name did not delete the other 196 frames. The conversation table is the count of frames in the file, not a count of users. The client address 10.9.0.2 is in the sample. It is not a person and not this machine.
Field names change between versions. The filter used here worked on 4.2.2. The download page's stable label was 4.6.9. Test the filter on the binary you will run. TShark does not decrypt TLS unless you give it keys, and this run did not. The SNI is the name in the handshake, not the contents of the HTTP/2 session.
Screenshots
05
Potential use cases
06
- A pipeline needs one field, not a window. On 18 Oct 2026 tshark --version printed TShark (Wireshark) 4.2.2, packaged as 4.2.2-1.1build3. The server-name field extraction on the sample returned one value, www.mozilla.org. Put the version line and the field in the same note. The filter worked on this binary, not on a version you have not run.
- You need a count rather than a dissection. The conversation statistic showed one TCP conversation: 92 frames and 222 kB one way, 105 frames and 9,383 bytes the other, 197 frames and 232 kB total, lasting 182.8 seconds, between 10.9.0.2 port 59246 and 104.16.40.2 port 443. That is a frame count, not a user count.
- A script assumes the download page's stable 4.6.9. TShark follows the Wireshark package you installed. This host was 4.2.2. Test the field name on that binary. tcpdump on the same file did not print the server name. Use TShark when the handshake field is the point, and say that it still does not decrypt the session.
Hard cases
The case where the first result is easy to over-read.
One printed name becomes the whole file
The display filter that printed www.mozilla.org did not remove the other frames. The conversation table is the count of packets in the sample. The client address 10.9.0.2 is in that public file. It is not this host. Quote 4.2.2 for the run and 4.6.9 only as the download page's stable label.
Practitioners using it
Posts on X from people describing a concrete use. The quote is the post. Likes and reposts are the counts saved with it, not a live total. A label marks a creator, a maintainer, a vendor, a partner, a data partner, or an investor.
Using #tshark ( #wireshark cmd) to monitor #DNS traffic: tshark -i 2 -Y "dns.a and not mdns" -T fields -e ip.src -e udp.srcport -e https://t.co/eMakld4xh4 -e dns.a -e dns.cname pic.twitter.com/rTCCzuAeYW
Let's grab the SNI names using tshark! #Wireshark tshark -r wifi_is_safe_00001_20241113183046 -Y "tls.handshake.type == 1" -T fields -e tls.handshake.extensions_server_name
Modbus Clients with function codes tshark -n -Y "mbtcp && tcp.dstport == 502" -T fields -e ip.src -e modbus.func_code -r <file.pcap> | sort | uniq
Did you ever want to extract the dns queries from a pcap? use tshark: tshark -r wifi_is_safe_00002_20241113201515 -Y "dns.flags.response eq 0" -T fields -e https://t.co/ixM0bnT2jT > pcap_dns_query.txt pic.twitter.com/WuINFKIuqA
Questions
Is TShark free?
It ships with Wireshark. The SPDX field is GPL-2.0, and the download page did not print a separate TShark price. This host ran 4.2.2.
Is TShark a different capture tool from tcpdump?
Yes. TShark dissects with Wireshark's decoders. tcpdump prints packets with libpcap. This listing ran both on the same sample file.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
Wireshark, which ships TShark
https://www.wireshark.org/Pricing
Wireshark download
https://www.wireshark.org/download.htmlDocumentation
TShark manual
https://www.wireshark.org/docs/man-pages/tshark.html