You can analyze the Linux server directly on itself. You don’t have GUI (X Windows) or don’t use it. If you are logged in as a regular, non-root user, you need sudo rights to use the TShark utility and need adding “sudo” prefix to all commands. In Debian or Ubuntu or derivatives, you can install with the following command: # apt-get install tsharkĬheck the installation with the following command: # tshark -v In RHEL machines you can install with the following command: # yum install wireshark So A Linux Shell and Wireshark lover should prefer using TShark. However, if you a Wireshark lover, you can use Wireshark in the shell. Tcpdump is a powerful command-line tool that helps ease the pain of troubleshooting network issues. If you’ve ever dived deep into the Linux world, you’ve heard of Tcpdump or used it. If you are a system engineer, you have to work in black screens named as the shell or maybe you don’t like graphic interfaces like me. But Wireshark requires a graphic user interface (GUI). When we talk about network sniffing, Wireshark is the first thing that comes to mind. the same as the >= operator) see the pcap-filter(7) man page for more details.Whatever you are a DevOps engineer or system administrator or Linux administrator and even software engineer, you need to analyze network packets. In the case of greater, it uses the overall captured frame length, and actually means greater-than-or-equal-to (i.e.

In the case of udp, we're using the UDP header's 16-bit length field, which includes the header itself. Tshark -i eth0 -n -f 'udp port 123 and greater 91' -w file.pcapīoth of the above filters are designed to capture NTP packets greater than the most common 48-byte UDP payload. Tcpdump -i eth0 -n -s 0 -vv 'udp port 123 and udp > 56' Here's an example of tcpdump doing the former (displaying it to the terminal), and tshark doing the latter (writing it to a file): However, the capability is there in both tcpdump and tshark, using either indexing into the UDP header, or using the overall captured frame length. I started searching and found that not many quick guides exist to do this in the capture filter. Because the overall number of NTP packets is quite large, I didn't want to spool all NTP packets to disk then later filter with a Wireshark display filter - I wanted to filter at the capture stage. I recently wanted to look at some packet captures on my NTP pool servers and find out if any NTP clients hitting my servers use extension fields or legacy MACs.

Tshark filter