tshark análisis

tshark -r capture.pcap -Y 'dns.qry.name'

Analyze a pcap with tshark filtering by specific fields (here DNS queries) to extract network behavior without opening Wireshark.

Run it on captures when you need to extract specific information quickly and reproducibly: tshark is Wireshark on the command line, and the display filter (-Y) lets you pull only what matters from a pcap — DNS queries (to spot DGA or DNS C2), connections to a host, TLS handshakes. In an IR with multiple pcaps, looping tshark with filters turns hours of visual analysis into minutes of commands. Output in CSV or specific fields (-T fields) feeds timelines and the report.

Don't use it for deep interactive analysis: for exploring a pcap without knowing what to look for, Wireshark (or the GUI) is still faster. The -Y filter requires knowing field names (dns.qry.name, ip.src...) — without that, attempts fail or return empty; check names with tshark -G fields or the field reference. And watch out for size: tshark on huge pcaps (GBs) is slow and memory-hungry; read filters (-R doesn't apply, but -Y on the whole file) don't avoid full parsing — for large pcaps, split or use Zeek.