# Tshark & Command Line Analysis

Wireshark is great, but its graphical interface crashes when trying to open massive PCAP files (e.g., a 10GB capture from a busy router). 

When dealing with Big Data, analysts turn to **Tshark**.

## What is Tshark?
Tshark is the command-line version of Wireshark. It uses the exact same parsing engine and the exact same display filters, but it runs entirely in the terminal.

Because it doesn't have to render a GUI, it is incredibly fast and uses vastly less RAM. It is also easily scriptable in Bash.

## Basic Syntax
*   **Read a PCAP:** `tshark -r capture.pcap`
*   **Apply a Filter:** `tshark -r capture.pcap -Y "http.request.method == GET"` (Notice the capital `-Y` for display filters).

## The Power of Fields (-T fields)
The true power of Tshark is its ability to extract only specific pieces of data from a packet, turning a messy PCAP into a clean CSV file that can be fed into Excel, Splunk, or ElasticSearch.

Use `-T fields` to tell Tshark you only want specific data.
Use `-e <field_name>` to specify exactly what you want.

**Example 1: Extract all DNS queries**
`tshark -r capture.pcap -Y "dns.flags.response == 0" -T fields -e dns.qry.name`
*This tells Tshark: Read the file, filter for DNS requests (not responses), and print out only the domain name that was queried.*

**Example 2: Create an HTTP forensic timeline**
`tshark -r capture.pcap -Y http.request -T fields -e frame.time -e ip.src -e http.request.uri -e http.user_agent`
*This creates a clean log file showing the Time, the Source IP, the requested URL, and the User-Agent for every HTTP request in the entire capture.*

## Combining with Bash
Because Tshark outputs text, you can pipe it into standard Linux tools like `grep`, `sort`, and `uniq`.
If you want to see the top 5 most frequently visited domains:
`tshark -r capture.pcap -Y dns -T fields -e dns.qry.name | sort | uniq -c | sort -nr | head -n 5`