https://ctf.adamino.dk/tags/packet-analysis/Recent content in Packet-Analysis on Adamino CTF WriteupsHugoenAdamino 2023Sun, 23 Aug 2026 14:45:00 +0100https://ctf.adamino.dk/tools/forensics/tshark/Sun, 23 Aug 2026 14:45:00 +0100https://ctf.adamino.dk/tools/forensics/tshark/<h1 id="tshark--wireshark-reading-packet-captures">tshark &amp; Wireshark: Reading Packet Captures<a href="#tshark--wireshark-reading-packet-captures" class="anchor" aria-hidden="true"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"> <path d="M15 7h3a5 5 0 0 1 5 5 5 5 0 0 1-5 5h-3m-6 0H6a5 5 0 0 1-5-5 5 5 0 0 1 5-5h3"></path> <line x1="8" y1="12" x2="16" y2="12"></line> </svg></a></h1> <p>When a forensics challenge hands you a <code>.pcap</code> or <code>.pcapng</code>, <a href="https://www.wireshark.org/">Wireshark</a> and its command-line sibling <strong>tshark</strong> are how you turn a wall of packets into an answer. Wireshark&rsquo;s GUI is unbeatable for exploring an unfamiliar capture; <code>tshark</code> is unbeatable for extracting exactly the fields you need into a form you can script against. You&rsquo;ll use both — GUI to find the needle, <code>tshark</code> to pull it out in bulk.</p>