Tshark is a command-line tool that you can run from a Linux based distribution.
It is helpful in capturing packet data.
It's very similar to what you do with Wireshark.
However, it is Wireshark at the command-line, at the terminal.
So, although it does a lot of the same things
you have to learn how to manipulate it in a way
where you can get those specific things
or those actions out of them by using switches and command-line data.
So, what can you do with tshark? You can capture packets.
You can display packets. You can select different interfaces.
You can run statistics. You can use profiles.
YOu can use a lot of the same things, although not everything
that you can do in a GUI but
as mentioned in the Q&A, there's a lot of things that are very similar.
You can merge capture files. There's separate command-line utilities
for those specific functions. However, it requires a basic knowledge
of Linux and Unix command-line to be able to manipulate.
So, some examples of important things that you should take note of.
You would need to be a super user
preferably, we do not like to log in as root on a Unix or Linux box.
But you would obviously have to have super user permissions to do certain functions.
So, you may have to modify some files to, to be able to use tshark in all it's functionality.
You have to remember that with Unix and Linux,
there's a lot of uppercase, lowercase settings or things that you would type in.
And with Unix and Linux, it's primarily case sensitive.
So you would have to aware of that to navigate the command-line or the shell.
In Unix, you have to be aware of setting the shell and
being aware of how that's going to output if you wanted to modify a file.
Sometimes you would use the, the Vi editor, as an example.
So there's some, some Unix and Linux basics that you're going to have to be able to use this.
Otherwise, a good way to learn as I have up on the screen now is you can download VMware.
You can get any of many different distributions of Linux to load up and to test with.
It's recommended though, if you're going to set up a
Linux machine to do packet capture that is not on a VM.
This is just for instructional purposes.
You'd want it on the base machine.
It interacts directly with you NIC instead of the VNIC.
So, altough this is helpful, it's only really looking and analyzing stuff
on the host machine right now, so it's limited but
if you're going to really do this and install Linux on a machine to use in the field
to do protocol, packet and network analysis
you can install that directly to the host machine.
That being said, you can basically also load the Wireshark GUI on Linux.
So, whatever you aren't using tshark for,
anything that you want to be using -GUI, generally, it's also loaded.
Also when you install Wireshark, you have the options to put it in
or take it out, so just be aware that when you did install it,
hopefully you chose everything and it's already there,
if not, you may need to add it.
So as we mentioned earlier, tshark is capable of running a packet capture on your system.
It is customizable. We talked about on Q&A, there's different things that you can do with it.
There's a man page, if you are familiar with Linux.
Unix'ish man pages, you can type in man, MAN, space, tshark.
And it will give you many of the option settings that you need.
And you can do that with editcap, merge cap, the rest as well.
Basically, they're just executables that you're trying,
or I should say binaries that you're trying
to figure out switches for or arguments so that you can customize the strength
and pull exactly what you need from tshark.
And how do you use it?
Obviously, you would need some basic Unix and Linux system,
systems administration skills.
I already went over basically what they need to be.
It's not impossible to do. Most of you, if you're using Cisco devices,
Linux is fairly easy because you're used to manipulating the command-line.
There's also obviously if you're using Bash or some kind of shelves, it's a GUI-like window.
So between the 2, it's very, very simple to use
just make sure that when you install it,
you follow the same criteria of adding the things that you need.
You have the proper systems requirements which you can find on wireshark.org.
And you have permissions to install which generally,
and configured Wireshark installation and configuration files which would require
something other than a user privilege.
And as we noted before, you're going to be running
this from the terminal window - tshark terminal.
And you should learn how to use the man pages which is basically
your view into help files, if you will.
As if you're going to type a question mark at a command prompt in Cisco.
or you're trying to figure out more infromation. Man pages are generally
where you can find these different switches and so on and so forth.
So there's a lot of questions about the Nexus and it's packet capture capability.
So you have the eth analyzer, you have the ability to capture packets
and get them into a device such as Wireshark to analyze.
I believe the question was 'is tshark directly on the Nexus platform?'
I do not believe so. I believe that it is not tshark, it's eth analyzer.
Just as it may have the same functionality but I, it's named different.
So I do not believe that it is called tshark. So I hope that answers that question.
But they can be used together.
You can take the data and you can use it in Wireshark.
So we will talk about that in the last 2 modules, I believe. It's file formats.
And that's why file formats is so important because with file formats
you're going to be moving the data around and opening in other things
and if you do not have it the correct format then you either mght not open it
or you may lose data. So just we mentioned when we were talking about timestamps,
so you can put it from one to the other, and it will lose, for example, nanoseconds
if the other analyzer you opened it in does not allow for that.
So, I hope I answered that question. Let's see what else we have.
Launching tshark, multiple tsharks -
So you can open up tshark, multiple instances of tshark.
Yes, and you can use it to capture different things.
Yes, so as an example of hiding it on the system,
as a background process. Yes, and let's see what else.
And as far as trying to determine packet loss, yes, if you did Wireshark or tshark on one
close to the source or on the source, or close to the destination or on the destination
and you ran the same statistics that we did
when we looked at the GUI version of Wireshark,
you can then determine the same types of things
which will be the roundtrip.
Packet loss could be determined by many things but
Wireshark and or tshark can help you come to that conclusion.