Hacker News Reader

Real hackers use tshark :) [1] I try to get my students doing everything from commandline, creating pcap files. When they finally see the GUI of Wireshark they think they died and went to heaven.

[1] It's actually the capture part of Wireshark

View on HN

Apologies for "well, actually"-ing here, but the capture part of Wireshark is dumpcap and the various extcap utilities (sshdump, ciscodump, etc). TShark is the command line interface to Wireshark's dissection engine, which, as you point out can be a really useful thing to have. It ships with a bunch of other command line utilities as well, such as editcap, mergecap, and capinfos: https://www.wireshark.org/docs/man-pages/

> sshdump

Thanks for that handy one I'd missed until now!

Reply on news.ycombinator.com