-q: Suppress output of each captured packets.To investigate inbound traffic, specify destination host is an own IP address. -f 'dst host 172.17.XXX.XXX': Set the capture filter expression.-a duration:60: Specify the condition of stopping tshark.| Interval | Frames | Bytes | Frames | Bytes | Frames | Bytes | $ tshark -a duration:60 -f 'dst host 172.17.XXX.XXX' -q -z io,stat,10,tcp,udp Notes: For the sake of convenience, I rewrote some of the commands, outputs, IP addresses, figures and others by hand. In this post, I investigated network traffic by using the statistical information displayed by -z option.Īt first, I see the ratio between TCP and UDP of this packets. z is one of the best useful options implemented in tshark, it allows you to display statistical information. You can see how to use tshark by man command, or some nice articles were written already. It is a similar tool from the point of view that it can capture packets and display the contents however, tshark is a more helpful tool that has many functions, such as to decode the packets into Human-Readable and to aggregates packets over a given time interval and calculates statistical information. Tcpdump is one of the most famous tools as CUI-based packet capture tool. This article was written with Tshark 1.8.10, installed by wireshark-1.8.86_64 If you are using RHEL-based distribution, You can use tshark by installing wireshark package.

This article provides that how to investigate network traffic breakdown using tshark.

This graph represents network traffic of a server.Ĭoncrete figures have been masked, however, it can be seen that network traffic volume is gradually increasing over several weeks.

Using tshark