https://lead-devops.blackdevhub.online/en/tags/tshark/Recent content in Tshark on Lead DevOpsHugoen-USThu, 03 Sep 2026 00:00:00 +0000https://lead-devops.blackdevhub.online/en/posts/tcpdump-tshark-cli-packet-capture/Thu, 03 Sep 2026 00:00:00 +0000https://lead-devops.blackdevhub.online/en/posts/tcpdump-tshark-cli-packet-capture/<p>When debugging network issues in Linux infrastructure, <code>ping</code> and <code>curl</code> are not enough. Sometimes you need to see what is actually traveling over the wire. tcpdump is the standard tool for capturing packets from the CLI. tshark is its sibling from the Wireshark suite, convenient for scripting.</p> <h2 id="quick-start-with-tcpdump">Quick Start with tcpdump </h2> <p>Check that packets are reaching the host:</p> <div class="td-code td-code--untitled" id="td-code-4d81bd54-fence-0" data-td-code data-td-code-auto-id data-td-language="bash" data-td-line-count="1"> <div class="td-code__viewport" id="td-code-4d81bd54-fence-0-viewport" data-td-code-viewport><div class="highlight"><pre tabindex="0" class="chroma"><code class="language-bash" data-lang="bash"><span class="line"><span class="cl">tcpdump -i eth0 host 10.0.0.5</span></span></code></pre></div></div> </div> <p>The utility puts the interface into promiscuous mode and prints one line per packet passing through. By default it works with the first interface it finds, but specifying explicitly is better.</p>