Skip to content
SPECIFICTION
Get listed

TShark

wireshark.org

Free plan WindowsmacOSLinux
Visit wireshark.org
Spec score 7.3 #17 of 22 in Network Packet Capture Software

What it is

TShark is the Wireshark project's terminal-mode utility for capturing and analyzing network traffic. It can capture live packets or read saved captures, decode packet data for output, and write captures to a file. Its native capture format is pcapng, and it can read and write formats supported by Wireshark. Display filters use Wireshark syntax to select packets and protocol fields. Output formats include fields, JSON, PDML, and text; capture controls include interface selection, capture filters, packet limits, and ring-buffer files. TShark can write ElasticSearch mapping data or pipe packet output to another program or script. One constraint is that display filters are unavailable when capturing and saving packets with the -w option. The manual sets a 2 TB maximum capture-file size and notes potential issues above 2^32 packets. The Wireshark project is maintained by the Wireshark Foundation, a nonprofit supported by donations. TShark is free under GNU GPL version 2 and runs on Linux, macOS, and Windows.

Spec sheet

Purpose
TShark captures live network traffic or reads saved captures, then decodes packets for output or writes them to a file.Read 30 Sep 2026 · wireshark.org
License
Wireshark is freely available under the GNU General Public License version 2, with no license fee for downloading.Read 30 Sep 2026 · wireshark.org
Maker
The Wireshark project is maintained by the Wireshark Foundation, described as a nonprofit supported by donations.Read 30 Sep 2026 · wireshark.org
Analysis limit
Display filters are not supported when TShark captures and saves packets with the -w option.Read 30 Sep 2026 · wireshark.org
Capture controls
Capture options include interface selection, capture filters, packet limits, and ring-buffer files.Read 30 Sep 2026 · wireshark.org
File size limit
The manual states that capture file size is limited to a maximum of 2 TB, and notes potential issues above 2^32 packets.Read 30 Sep 2026 · wireshark.org
Integration
TShark can write ElasticSearch mapping data and supports piping packet output to another program or script.Read 30 Sep 2026 · wireshark.org
Output
TShark can output packet data in formats including fields, JSON, PDML, and text.Read 30 Sep 2026 · wireshark.org
Packet formats
TShark uses pcapng as its native capture format and can read and write capture files supported by Wireshark.Read 30 Sep 2026 · wireshark.org
Project features
The Wireshark project describes TShark as its terminal-mode utility and lists live capture, offline analysis, protocol inspection, and display filters among its features.Read 30 Sep 2026 · wireshark.org
Protocol analysis
TShark provides display filters for selecting packets and protocol fields, using the same syntax as Wireshark.Read 30 Sep 2026 · wireshark.org
Security information
The documentation page links to security advisories covering past vulnerabilities and how to report a vulnerability.Read 30 Sep 2026 · wireshark.org
Support and learning
The project offers documentation, mailing lists, community forums, and educational resources including SharkFest.Read 30 Sep 2026 · wireshark.org
Supported systems
The project lists Windows, Linux, macOS, FreeBSD, NetBSD, and other platforms as supported by Wireshark.Read 30 Sep 2026 · wireshark.org

Plans and prices

Free Free GNU GPL v2 · network protocol analyzer Read 30 Sep 2026 · wireshark.org

Every TShark plan and price →

Strong points and limits

Strong points

  • Captures live traffic and reads saved captures
  • Uses Wireshark display-filter syntax
  • Offers fields, JSON, PDML, and text output
  • Supports capture filters and ring-buffer files
  • Free under GNU GPL version 2

Limits

  • Display filters are unavailable with capture-and-save using -w
  • Capture files have a stated 2 TB maximum
  • Manual notes potential issues above 2^32 packets

Who it suits

TShark suits users who need command-line capture and protocol analysis on Linux, macOS, or Windows, including workflows that pipe output to other programs.

Verdict

TShark provides command-line traffic capture, decoding, and filtering with several output choices. The -w display-filter limitation and documented capture-size constraints matter when planning capture workflows.

Where Specifiction places it

Alternatives to TSharkAll alternatives →