Tshark

When you want to capture some packets with tshark (commandline) you first have to discover which adapter you want to capture on

type first:

tshark -D

It will show your interfaces with a number in front of it which you can use to define adapter 1 / 2 / 3 / 4 / etc

So to capture 100 packets on interface 4 type:

tshark -i 4 -c 100 -w tip8.pcap

This will capture 100 packets on interface 4 with a filename of tip8.pcap (thanks to laura chappell!)
Unless otherwise stated, the content of this page is licensed under Creative Commons Attribution-ShareAlike 3.0 License