{
    "id": "tshark_cheat_sheet",
    "name": "Tshark",
    "description": "A network protocol analyzer",
    "metadata": {
        "sourceName": "Wireshark.org",
        "sourceUrl": "https://www.wireshark.org/docs/man-pages/tshark.html"
    },
    "aliases": [
        "command line wireshark",
        "terminal wireshark"
    ],
    "template_type": "terminal",
    "section_order": [
        "Installation",
        "Lower Case Options",
        "Upper Case Options",
        "Special Options"
    ],
    "sections": {
        "Installation": [
            {
                "key": "sudo apt-get install tshark",
                "val": "Install TShark on Ubuntu"
            },
            {
                "key": "tshark -i wlan0 -w capture-output.pcap",
                "val": "Basic Usage"
            }
        ],
        "Lower Case Options": [
            {
                "key": "-a <capture autostop condition>",
                "val": "Specify a criterion that specifies when TShark is to stop writing to a capture file"
            },
            {
                "key": "-b <capture ring buffer option>",
                "val": "Run Tshark in \"multiple files\" mode. Ex: -b filesize:1000 -b files:5 results in a ring buffer of five files of size one megabyte each"
            },
            {
                "key": "-c <capture packet count>",
                "val": "Set the maximum number of packets to read when capturing live data. If reading a capture file, set the maximum number of packets to read"
            },
            {
                "key": "-d <layer type>==<selector>,<decode-as protocol>",
                "val": "Specify how a layer type should be dissected. Ex: -d tcp.port==8888,http will decode any traffic running over TCP port 8888 as HTTP"
            },
            {
                "key": "-e <field>",
                "val": "Add a field to the list of fields to display if -T fields is selected"
            },
            {
                "key": "-f <capture filter>",
                "val": "Set the capture filter expression"
            },
            {
                "key": "-h",
                "val": "Print the version and options and exits"
            },
            {
                "key": "-i <capture interface> | -",
                "val": "Set the name of the network interface or pipe to use for live packet capture"
            },
            {
                "key": "-n",
                "val": "Disable network object name resolution (such as hostname, TCP and UDP port names); the -N flag might override this one"
            },
            {
                "key": "-p",
                "val": "Don't put the interface into promiscuous mode"
            },
            {
                "key": "-r <infile>",
                "val": "Read packet data from infile, can be any supported capture file format (including gzipped files)"
            },
            {
                "key": "-s <capture snaplen>",
                "val": "Set the default snapshot length to use when capturing live data"
            },
            {
                "key": "-u <seconds type>",
                "val": "Specifies the seconds type. Valid choices are: s for seconds hms for hours, minutes and seconds"
            },
            {
                "key": "-v",
                "val": "Print the version and exit"
            },
            {
                "key": "-w <outfile> | -",
                "val": "Write raw packet data to outfile or to the standard output if outfile is '-'"
            },
            {
                "key": "-x",
                "val": "Print a hex and ASCII dump of the packet data after printing the summary"
            },
            {
                "key": "-y <capture link type>",
                "val": "Set the data link type to use while capturing packets. The values reported by -L are the values that can be used"
            }
        ],
        "Upper Case Options": [
            {
                "key": "-B <capture buffer size>",
                "val": "Set capture buffer size (in MiB, default is 2 MiB)"
            },
            {
                "key": "-C <configuration profile>",
                "val": "Run with the given configuration profile"
            },
            {
                "key": "-D",
                "val": "Print a list of the interfaces on which TShark can capture, and exit"
            },
            {
                "key": "-E <field print option>",
                "val": "Set an option controlling the printing of fields when -T fields is selected"
            },
            {
                "key": "-F <file format>",
                "val": "Set the file format of the output capture file written using the -w option"
            },
            {
                "key": "-H <input hosts file>",
                "val": "Read a list of entries from a \"hosts\" file, which will then be written to a capture file"
            },
            {
                "key": "-I",
                "val": "Put the interface in \"monitor mode\"; this is supported only on IEEE 802.11 Wi-Fi interfaces, and supported only on some operating systems"
            },
            {
                "key": "-K <keytab>",
                "val": "Load kerberos crypto keys from the specified keytab file. Ex: -K krb5.keytab"
            },
            {
                "key": "-N <name resolving flags>",
                "val": "Turn on name resolving only for particular types of addresses and port numbers, with name resolving for other types of addresses and port numbers turned off"
            },
            {
                "key": "-Q",
                "val": "When capturing packets, only display true errors"
            },
            {
                "key": "-S <separator>",
                "val": "Set the line separator to be printed between packets"
            },
            {
                "key": "-V",
                "val": "Print a view of the packet details"
            },
            {
                "key": "-W <file format option>",
                "val": "Save extra information in the file if the format supports it"
            },
            {
                "key": "-X <eXtension options>",
                "val": "Specify an option to be passed to a TShark module. The eXtension option is in the form extension_key:value"
            },
            {
                "key": "-Y <displaY filter>",
                "val": "Applies specified filter before printing a decoded form of packets or writing packets to a file"
            }
        ],
        "Special Options": [
            {
                "key": "-2",
                "val": "Perform a two-pass analysis. Also permits reassembly frame dependencies to be calculated correctly"
            },
            {
                "key": "-G",
                "val": "A special mode to dump one of several types of internal glossaries and then exit"
            },
            {
                "key": "-z <statistics>",
                "val": "Collects various types of statistics and display the result after finishing reading the capture file"
            }
        ]
    }
}
