Wireshark ships with a family of command-line companions that support scripted and remote workflows. TShark is the CLI counterpart to the GUI, capable of capturing with tshark -i eth0 -w output.pcapng, reading files with tshark -r input.pcapng, applying display filters via -Y, and emitting selected fields with -T fields -e ip.src -e ip.dst. Dumpcap is the lower-level capture engine used by both Wireshark and TShark, and it accepts the same kinds of options, including -b filesize for ring-buffer-style file rotation. Mergecap combines several capture files into one with mergecap -w merged.pcapng file1.pcap file2.pcap, and Editcap edits existing files, supporting tasks like splitting every 1000 packets with editcap -c 1000 input.pcapng output.pcapng, deduplicating with -d, and other transformations.
Additional utilities round out the toolkit. Reordercap sorts a capture's packets by timestamp, which is useful when merging logs from sources with skewed clocks. Text2pcap converts a hex-dump text file into a pcap capture file, allowing users to construct traces from logs or documentation. Capinfos reports metadata about a capture file, including its format, size, duration, and packet counts, which is helpful for quickly summarizing a large corpus of files.
These tools combine into practical workflows for many common tasks. Troubleshooting slow network performance often starts with an I/O Graph and the Round Trip Time TCP Stream Graph, followed by filters for retransmissions and zero windows. DNS issues can be investigated by filtering dns and checking for NXDOMAIN responses, while HTTP problems are typically isolated with http.response.code >= 400 and inspected request by request. TLS handshake failures are diagnosed by inspecting tls.handshake and the Alert records. Security investigations rely on patterns like tcp.flags.syn == 1 && tcp.flags.ack == 0 for SYN floods, ip.flags.mf == 1 && ip.frag_offset > 0 for fragmented traffic, http.authorization for exposed credentials, and dns.qry.name matches for suspicious domain patterns, with Conversations and I/O Graphs providing the high-level summaries that tie individual packets into a coherent narrative.