name: tshark
category: network
description: Terminal-based Wireshark for packet capture and analysis.
keywords:
  - packet
  - capture
  - wireshark
  - protocol
  - analysis
  - network

parameters:
  interface:
    type: string
    flag: "-i"
    description: Capture interface

  read:
    type: string
    flag: "-r"
    description: Read from pcap file

  write:
    type: string
    flag: "-w"
    description: Write to pcap file

  filter:
    type: string
    flag: "-f"
    description: Capture filter (BPF)

  display_filter:
    type: string
    flag: "-Y"
    description: Display filter

  count:
    type: integer
    flag: "-c"
    description: Packet count

  fields:
    type: string
    flag: "-e"
    description: Fields to display (use with -T fields)

  format:
    type: enum
    flag: "-T"
    options:
      - value: "fields"
        description: "Custom fields"
      - value: "json"
        description: "JSON format"
      - value: "pdml"
        description: "PDML XML"
      - value: "psml"
        description: "PSML XML"
    description: Output format

  verbose:
    type: boolean
    flag: "-V"
    description: Verbose packet details

  quiet:
    type: boolean
    flag: "-q"
    description: Quiet mode

  statistics:
    type: string
    flag: "-z"
    description: "Statistics type (e.g., io,stat)"

requires_root: true
timeout: 0
interactive: true

examples:
  - "tshark -i eth0"
  - "tshark -i eth0 -w capture.pcap"
  - "tshark -r capture.pcap -Y 'http'"
  - "tshark -r capture.pcap -T fields -e ip.src -e ip.dst -e tcp.port"
  - "tshark -i eth0 -f 'port 80' -Y 'http.request'"
  - "tshark -r capture.pcap -z io,stat,1"

notes: |
  Display filters:
  - http, dns, tcp, udp
  - ip.addr == 192.168.1.1
  - tcp.port == 80
  - http.request.method == "POST"
  - frame contains "password"

  Capture filters (BPF):
  - host 192.168.1.1
  - port 80
  - tcp and port 443
  - not broadcast

  Statistics (-z):
  - io,stat: I/O statistics
  - http,tree: HTTP request tree
  - conv,tcp: TCP conversations
  - endpoints,ip: IP endpoints

  Extract data:
  - HTTP objects: -z export
  - Specific fields: -T fields -e