### Usage Example for Tab Group Shortcode

Source: https://github.com/pocc/tshark.dev/blob/master/docs/PROMPT_RECOMMENDATIONS.md

Demonstrates how to use the `tabgroup` and `tab` shortcodes to create OS-specific installation instructions. Each `tab` shortcode defines a button and its associated content panel.

```markdown
{{</* tabgroup */>}}
{{</* tab name="Linux" */>}}
```bash
sudo apt install wireshark
```
{{</* /tab */>}}
{{</* tab name="macOS" */>}}
```bash
brew install --cask wireshark
```
{{</* /tab */>}}
{{</* tab name="Windows" */>}}
```powershell
choco install wireshark
```
{{</* /tab */>}}
{{</* /tabgroup */>}}

```

--------------------------------

### Install Wireshark on Windows

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Use Chocolatey to install Wireshark on Windows.

```bash
choco install wireshark
```

--------------------------------

### Install tcpreplay

Source: https://github.com/pocc/tshark.dev/blob/master/content/edit/sanitizing_hex.md

Use your system's package manager to install the tcpreplay suite of tools. This is required for the tcprewrite command.

```sh
# Ubuntu / Ubuntu WSL on Windows
apt install tcpreplay
# Macos
brew install tcpreplay
```

--------------------------------

### Install Wireshark on macOS

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Use Homebrew to install Wireshark on macOS.

```bash
brew install --cask wireshark
```

--------------------------------

### Install Wireshark v3.0.0 from Source on Linux

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Download, extract, and build Wireshark v3.0.0 from source on Linux. This method is necessary if v3 is not available in official repositories. Ensure all dependencies are installed before running cmake, make, and make install.

```bash
wget https://www.wireshark.org/download/src/wireshark-3.0.0.tar.xz -O /tmp/wireshark-3.0.0.tar.xz
tar -xvf /tmp/wireshark-3.0.0.tar.xz
cd /tmp/wireshark-3.0.0

sudo apt update && sudo apt dist-upgrade
sudo apt install cmake libglib2.0-dev libgcrypt20-dev flex yacc bison byacc \
  libpcap-dev qtbase5-dev libssh-dev libsystemd-dev qtmultimedia5-dev \
  libqt5svg5-dev qttools5-dev
cmake .
make
sudo make install
```

--------------------------------

### Install tshark on Arch Linux

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Install the wireshark-cli package on Arch Linux.

```bash
sudo pacman -S wireshark-cli
```

--------------------------------

### Install tshark on CentOS/Fedora/RedHat

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Install the wireshark-cli package on CentOS 8, Fedora 30, or RedHat.

```bash
sudo dnf install wireshark-cli
```

--------------------------------

### Install Pagefind Build Script

Source: https://github.com/pocc/tshark.dev/blob/master/docs/PROMPT_RECOMMENDATIONS.md

Add this package.json to your project root to manage the Pagefind build process.

```json
{
  "private": true,
  "scripts": {
    "build": "hugo --gc --minify && npx pagefind@latest --site public",
    "dev": "hugo server"
  }
}
```

--------------------------------

### Install Hugo

Source: https://github.com/pocc/tshark.dev/blob/master/README.md

Install Hugo, the static site generator used for tshark.dev. Refer to the official Hugo documentation for detailed installation instructions.

```bash
Install hugo
```

--------------------------------

### Install Dependencies and Run Scripts

Source: https://github.com/pocc/tshark.dev/blob/master/docs/ARCHITECTURE.md

Use these npm commands to manage project dependencies and run development, build, and deployment tasks.

```bash
# Install dependencies (wrangler)
npm install
```

```bash
# Serve locally via Hugo dev server
npm run dev
# Default: http://localhost:1313
```

```bash
# Build static site
npm run build
```

```bash
# Preview via Cloudflare Workers local runtime
npm run preview
# Default: http://localhost:8787
```

```bash
# Deploy to Cloudflare Workers
npm run deploy
```

--------------------------------

### Dockerfile for Tshark Installation

Source: https://github.com/pocc/tshark.dev/blob/master/content/packetcraft/arcana/profiles.md

A basic Dockerfile to set up an Ubuntu environment with Tshark installed. This is a starting point for containerized packet analysis workflows.

```dockerfile
# Dockerfile
FROM ubuntu:22.04
RUN apt-get update && apt-get install -y tshark

```

--------------------------------

### Install tshark from Source (Linux)

Source: https://context7.com/pocc/tshark.dev/llms.txt

Installs tshark version 3.x from source on Linux systems. Requires build tools and development libraries.

```bash
wget https://www.wireshark.org/download/src/wireshark-3.0.0.tar.xz -O /tmp/wireshark-3.0.0.tar.xz
tar -xvf /tmp/wireshark-3.0.0.tar.xz
cd /tmp/wireshark-3.0.0
sudo apt install cmake libglib2.0-dev libgcrypt20-dev flex yacc bison byacc \
  libpcap-dev qtbase5-dev libssh-dev libsystemd-dev qtmultimedia5-dev \
  libqt5svg5-dev qttools5-dev
cmake . && make && sudo make install
```

--------------------------------

### Install tshark on FreeBSD

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Install the tshark package on FreeBSD version 11 and above.

```bash
pkg install tshark
```

--------------------------------

### Verify tshark Installation and List Interfaces

Source: https://context7.com/pocc/tshark.dev/llms.txt

Checks the installed tshark version, lists available network interfaces, and verifies all Wireshark utilities are in the system's PATH.

```bash
# Check version
tshark --version
# TShark (Wireshark) 3.0.2 (v3.0.2-0-g621ed351d5c9)
```

```bash
# List interfaces
tshark -D
```

```bash
# Check all Wireshark utilities are on $PATH
utils=(androiddump capinfos captype dumpcap editcap mergecap randpkt reordercap text2pcap tshark)
for util in ${utils[*]}; do
  [[ -z $(which $util) ]] && echo "Missing: $util"
done
```

--------------------------------

### Start Hugo Server

Source: https://github.com/pocc/tshark.dev/blob/master/README.md

Start the local Hugo development server to preview the tshark.dev website. The default address is localhost:1313.

```bash
hugo server
```

--------------------------------

### Complete Tshark Optimization Example

Source: https://github.com/pocc/tshark.dev/blob/master/content/analyze/performance.md

An optimized processing pipeline for multi-GB captures, disabling unnecessary protocols and options, and enabling specific ones for performance gains.

```bash
#!/bin/bash
# Optimized processing for 100GB+ captures

CAPTURE="huge_capture.pcap"
OUTPUT="results.json"

tshark -r "$CAPTURE" \
    --disable-all-protocols \
    --enable-protocol frame \
    --enable-protocol eth \
    --enable-protocol ip \
    --enable-protocol tcp \
    --enable-protocol http \
    -M 100000 \
    -o "tcp.analyze_sequence_numbers:false" \
    -o "tcp.calculate_timestamps:false" \
    -o "tcp.check_checksum:false" \
    -o "ip.check_checksum:false" \
    -o "ip.defragment:false" \
    -Y "http.request" \
    -T json \
    -J "http" \
    --no-duplicate-keys \
    > "$OUTPUT"
```

--------------------------------

### Install Wireshark on Linux

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Use your package manager to install Wireshark on Linux. Note that Wireshark v3 may not be available on all Linux package managers.

```bash
$PkgManager install wireshark
```

--------------------------------

### Install Node.js Dependencies for tshark.dev

Source: https://context7.com/pocc/tshark.dev/llms.txt

Install necessary Node.js dependencies, including wrangler and pagefind, for the tshark.dev documentation site.

```bash
npm install
```

--------------------------------

### Serve tshark.dev Locally with Hugo

Source: https://context7.com/pocc/tshark.dev/llms.txt

Start a local Hugo development server for the tshark.dev site, which includes hot-reloading for immediate feedback.

```bash
npm run dev
```

--------------------------------

### Example Pcapng Output

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/sample_capture_headers.md

This output demonstrates the parsed components of a pcapng file, including headers, packets, and footer, as processed by a capture file parser.

```bash
Header+packet0 header:
0a0d0d0ac80000004d3c2b1a01000000ffffffffffffffff02003700496e74656c28522920436f726528544d292069372d34373730485120435055204020322e323047487a20287769746820535345342e32290003002e004d6163204f5320582031302e31342e352c206275696c6420313846313332202844617277696e2031382e362e302900000400320044756d70636170202857697265736861726b2920332e302e33202876332e302e332d302d6736313330623932623065633629000000000000c80000000100000068000000010000000000080002000300656e30000300050057692d466900000009000100060000000c002e004d6163204f5320582031302e31342e352c206275696c6420313846313332202844617277696e2031382e362e302900000000000068000000060000007c000000000000006a8f0500a02afb175a0000005a000000

Packet <span class="m">0</span>:
6c96cfd87fe7cc65adda397008004500004c1ad8400031066dc98c52721ac0a801f601bbd53da3d069e9ca0efbcd8018001fe2b400000101080a08d51bb33ea6da3117030300130ac92e61a016dad04ffdd0a697e7b3d9644647

Packet Header <span class="m">1</span>:
00007c0000000600000064000000000000006a8f0500f42afb174200000042000000

Packet <span class="m">1</span>:
cc65adda39706c96cfd87fe708004500003400004000400679b9c0a801f68c52721ad53d01bbca0efbcda3d06a01801007fff31900000101080a3ea7acc208d51bb3

Packet Header <span class="m">2</span>:
0000640000000600000080000000000000006a8f0500ac2cfb175e0000005e000000

Packet <span class="m">2</span>:
cc65adda39706c96cfd87fe7080045000050000040004006799dc0a801f68c52721ad53d01bbca0efbcda3d06a0180180800013f00000101080a3ea7acc208d51bb317030300172525d27b6d058c1236bccb185f56ffc1634643ae8c252e

Footer: 000080000000050000006c000000000000006a8f05003dbafd1701001c00436f756e746572732070726f76696465642062792064756d70636170020008006a8f050056e4f917030008006a8f05000abafd17040008000300000000000000050008000300000000000000000000006c000000
```

--------------------------------

### 5views File Header Example

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/sample_capture_headers.md

Hexadecimal representation of the header for the 5views capture file format.

```text
# 5views File Header
00000000: AAAA AAAA 2000 0000 0000 0100 1800 0000  .... ...........
```

```text
00000010: 0010 0018 0000 0000 0000 0000 0000 0000  ................
```

```text
00000020: 0700 0080 0400 0100 FCC7 445D 0000 0020  ..........D]...
```

```text
00000030: 0400 0100 0000 0000                      ........
```

--------------------------------

### Modernized Hugo Configuration (config.toml)

Source: https://github.com/pocc/tshark.dev/blob/master/docs/PROMPT_RECOMMENDATIONS.md

A comprehensive `config.toml` example demonstrating modern Hugo settings, including base URL, language, metadata, feature flags, and detailed markup/minify configurations.

```toml
baseURL = "https://tshark.dev/"
languageCode = "en-US"
defaultContentLanguage = "en"
title = "tshark.dev — Packet Analysis"
metaDataFormat = "yaml"

enableRobotsTXT = true
enableGitInfo = true          # Enables .GitInfo for "last modified" dates

# Disable the old theme — we're using custom layouts now
# themesdir = "themes"

[params]
  editURL = "https://github.com/pocc/tshark.dev/blob/master/content/"
  description = "Your complete guide to packet analysis on the command line"
  author = "Ross Jacobs"
  version = "v2.0"

[outputs]
  home = ["HTML", "RSS"]     # Remove JSON (was for Lunr.js; Pagefind indexes HTML)

[markup]
  [markup.highlight]
    noClasses = false         # CSS-based syntax highlighting (no highlight.js)
    lineNos = false
    lineNumbersInTable = true
    tabWidth = 4
    guessSyntax = true
  [markup.goldmark.renderer]
    unsafe = true             # Allow raw HTML in Markdown
  [markup.tableOfContents]
    startLevel = 2
    endLevel = 4
    ordered = false

[minify]
  [minify.tdewolff]
    [minify.tdewolff.svg]
      precision = 0
    [minify.tdewolff.html]
      keepEndTags = true
      keepQuotes = true

[security]
  [security.funcs]
    getenv = ["^HUGO_"]
```

--------------------------------

### Install tshark on Alpine Linux

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Install the tshark package on Alpine Linux version 3.9 and above.

```bash
apk add tshark
```

--------------------------------

### Check Wireshark Version

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Verify the installed Wireshark version using the tshark command. If the version is not as expected, consider installing from source or using the official download page.

```bash
$ tshark --version
```

--------------------------------

### Build and Test Hugo Site

Source: https://github.com/pocc/tshark.dev/blob/master/CONTRIBUTING.md

Commands to build the Hugo site and check for broken links. Ensure you have Hugo installed.

```bash
# Build the site
hugo --gc

# Check for broken links
hugo server
```

--------------------------------

### Netmon1 File Header Example

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/sample_capture_headers.md

Hexadecimal representation of the header for the netmon1 capture file format.

```text
# netmon1 File Header
00000000: 5254 5353 0101 0100 B107 0C00 0300 1F00  RTSS............
```

```text
00000010: 1000 0000 0000 0000 8000 0000 0000 0000  ................
```

```text
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

--------------------------------

### Hugo Configuration Example

Source: https://github.com/pocc/tshark.dev/blob/master/docs/ARCHITECTURE.md

Key settings from the Hugo site configuration file (`config.toml`) that customize site behavior, metadata format, theme variants, and output formats.

```toml
baseURL = "https://tshark.dev/"
metaDataFormat = "yaml" # front matter is YAML, not TOML
themeVariant = "blue" # blue color theme
editURL points to GitHub master branch for "Edit this page" links
disableNextPrev = true # no prev/next navigation arrows
disableInlineCopyToClipBoard = "true"
enableRobotsTXT = true
Outputs: HTML, RSS, JSON (JSON enables Lunr.js search)
markup.goldmark.renderer.unsafe = true # allows raw HTML in Markdown
```

--------------------------------

### Output of Available Save Formats Script

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/save_formats.md

Example output from the `find_save_fmts.sh` script, listing the capture file formats that can be saved on a specific system.

```bash
bash$ bash find_save_fmts.sh
INFO: Saving 100 packet capture

### Formats that can be saved ###
  5views
  commview
  erf
  k12text
  lanalyzer
  modpcap
  netmon1
  netmon2
  nettl
  ngsniffer
  ngwsniffer_1_1
  ngwsniffer_2_0
  niobserver
  nokiapcap
  nsecpcap
  pcap
  pcapng
  rh6_1pcap
  snoop
  suse6_3pcap
  visual

```

--------------------------------

### Create and Index Packets

Source: https://github.com/pocc/tshark.dev/blob/master/content/packetcraft/arcana/reports.md

Creates an Elasticsearch index and indexes packets from a pcap file. Requires Tshark and curl to be installed.

```bash
curl -XPUT "http://localhost:9200/packets" \
     -H 'Content-Type: application/json' \
     -d @/tmp/mapping.json
```

```bash
tshark -r capture.pcap -T ek | \
    curl -XPOST "http://localhost:9200/packets/_bulk" \
         -H 'Content-Type: application/json' \
         --data-binary @-
```

--------------------------------

### Lanalyzer File Header Example

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/sample_capture_headers.md

Hexadecimal representation of the header for the Lanalyzer capture file format. Note that this output was truncated.

```text
# lanalyzer File Header
00000000: 0110 4C00 0105 5472 6163 6520 4469 7370  ..L...Trace Disp
```

```text
00000010: 6C61 7920 5472 6163 6520 4669 6C65 0000  lay Trace File..
```

```text
00000020: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
00000030: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
00000040: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
00000050: 0610 8000 4368 616E 6E65 6C31 0043 6861  ....Channel1.Cha
```

```text
00000060: 6E6E 656C 3200 4368 616E 6E65 6C33 0043  nnel2.Channel3.C
```

```text
00000070: 6861 6E6E 656C 3400 4368 616E 6E65 6C35  hannel4.Channel5
```

```text
00000080: 0043 6861 6E6E 656C 3600 4368 616E 6E65  .Channel6.Channe
```

```text
00000090: 6C37 0043 6861 6E6E 656C 3800 0000 0000  l7.Channel8.....
```

```text
000000a0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
000000b0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
000000c0: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
000000d0: 0000 0000 0B10 3600 5472 616E 7331 0000  ......6.Trans1..
```

```text
000000e0: 0054 7261 6E73 3200 0000 5472 616E 7333  .Trans2...Trans3
```

```text
000000f0: 0000 0054 7261 6E73 3400 0000 5472 616E  ...Trans4...Tran
```

```text
00000100: 7335 0000 0054 7261 6E73 3600 0000 3510  s5...Trans6...5.
```

```text
00000110: 9000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
00000120: 0000 0000 0000 0000 0000 0000 0000 0000  ................
```

```text
# OUTPUT TRUNCATED
```

--------------------------------

### Automated ELK Pipeline Setup

Source: https://github.com/pocc/tshark.dev/blob/master/content/packetcraft/arcana/reports.md

Sets up an automated ELK (Elasticsearch, Logstash, Kibana) pipeline for network traffic analysis. Generates an Elasticsearch mapping and streams Tshark output to Elasticsearch.

```bash
#!/bin/bash
# Automated ELK pipeline setup

# Generate minimal mapping for common protocols
tshark -G elastic-mapping \
    --elastic-mapping-filter "frame,eth,ip,tcp,udp,http,dns,tls" \
    > /tmp/tshark_mapping.json

# Create Elasticsearch index
curl -XPUT "http://localhost:9200/network-traffic" \
     -H 'Content-Type: application/json' \
     -d @/tmp/tshark_mapping.json

# Start ingestion
tshark -i eth0 -T ek -l | \
    while read -r line; do
        echo "$line" | \
        curl -XPOST "http://localhost:9200/network-traffic/_doc" \
             -H 'Content-Type: application/json' \
             -d @-
    done
```

--------------------------------

### Setup Environment Variables for Tshark Export

Source: https://github.com/pocc/tshark.dev/blob/master/content/export/export_regular.md

Define variables for destination directory, pcap file, HTML file, website URL, and protocol before running tshark commands.

```bash
dest_dir='/tmp'
cd $dest_dir
pcap_file="$dest_dir/neverssl.pcapng"
html_file="$dest_dir/neverssl.html"
website='http://neverssl.com'
protocol='http'
```

--------------------------------

### Extract Configured Fields with Lua Script

Source: https://github.com/pocc/tshark.dev/blob/master/content/packetcraft/scripting/lua_scripts.md

Usage example for the field extraction Lua script. It demonstrates passing a custom configuration string to extract specific TCP and HTTP fields.

```bash
# Extract configured fields
tshark -X lua_script:field_extractor.lua \
       -X lua_script1:"tcp.stream,tcp.port,http.host" \
       -r web.pcap
```

--------------------------------

### Decode As Rule Example

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/tshark.md

The -d option allows you to specify 'Decode As' rules, mapping a layer type and selector to a protocol. This is useful for dissecting non-standard protocols or ports.

```sh
tshark -d tcp.port==8888,http -r file.pcapng
```

--------------------------------

### Querying Extcap Interface Information

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/sources/extcap_interfaces.md

Use the --extcap-interfaces flag with an extcap utility to get information about available interfaces and their capabilities.

```bash
randpktdump --extcap-interfaces
extcap {version=0.1.0}{help=file:///usr/local/share/wireshark/randpktdump.html}
interface {value=randpkt}{display=Random packet generator}
```

--------------------------------

### Detecting Filetype with Captype

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/captype.md

Shows how to use captype to identify the file type of a specific file, even if its extension is misleading. This example reveals that 'example.pcap' actually contains pcapng data.

```bash
$ captype example.pcap
example.pcap: pcapng
```

--------------------------------

### Capture UDP Header with Snaplen

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/limit_size.md

Use the -s flag to set the snaplen, limiting the capture to a specific number of bytes. This example captures only the UDP header for IPv6 packets.

```bash
bash$  tshark -f 'ip6 and udp' -s 62 -c 1 -w ipv6_udp.pcapng -T fields \
              -e udp.srcport -e udp.dstport -e udp.length -e udp.checksum
```

--------------------------------

### Tshark Stream Processing

Source: https://github.com/pocc/tshark.dev/blob/master/content/analyze/get_info/rawshark.md

This example demonstrates how tshark can process a packet stream from standard input, providing a more user-friendly output compared to rawshark. It highlights tshark's versatility.

```bash
$ cat dhcp.pcap | tshark -r -

1   0.000000      0.0.0.0 → 255.255.255.255 DHCP 314 DHCP Discover - Transaction ID 0x3d1d
2   0.000295  192.168.0.1 → 192.168.0.10 DHCP 342 DHCP Offer    - Transaction ID 0x3d1d
3   0.070031      0.0.0.0 → 255.255.255.255 DHCP 314 DHCP Request  - Transaction ID 0x3d1e
4   0.070345  192.168.0.1 → 192.168.0.10 DHCP 342 DHCP ACK      - Transaction ID 0x3d1e
```

--------------------------------

### Set Tshark Entrypoint Preferences

Source: https://github.com/pocc/tshark.dev/blob/master/content/packetcraft/arcana/profiles.md

Configure Tshark preferences directly in the ENTRYPOINT for Docker or other containerized environments. This example disables TCP checksum validation and sets a custom HTTP port.

```bash
ENTRYPOINT ["tshark", "-o", "tcp.check_checksum:false", "-o", "http.tcp.port:8080"]
```

--------------------------------

### List Preferences for a Protocol

Source: https://context7.com/pocc/tshark.dev/llms.txt

Lists all default preferences associated with a specific protocol. Use grep with the protocol name followed by a dot.

```bash
tshark -G defaultprefs | grep -i "^http\."
```

```bash
tshark -G defaultprefs | grep -i "^tls\."
```

--------------------------------

### Load and Run a Lua Script

Source: https://context7.com/pocc/tshark.dev/llms.txt

Executes a simple Lua script that prints 'Hello World!'. The '-c 1' option limits the capture to one packet.

```bash
echo 'print("Hello World!")' > temp.lua
```

```bash
tshark -X lua_script:temp.lua -c 1
```

--------------------------------

### Install tshark on Debian/Ubuntu

Source: https://github.com/pocc/tshark.dev/blob/master/content/setup/install.md

Install the tshark package on Debian version 9 or Ubuntu version 14.04 and above.

```bash
sudo apt install tshark
```

--------------------------------

### Convert hexdump to pcap with dummy headers

Source: https://github.com/pocc/tshark.dev/blob/master/content/edit/text2pcap.md

This example demonstrates creating a pcap file from raw text data. It uses printf and xxd to format the input, then text2pcap to generate the pcap with dummy IP and TCP headers. The -t option specifies the timestamp format.

```bash
$ printf "I am a 27 byte TCP payload!" | xxd -g 1
00000000: 49 20 61 6d 20 61 20 32 37 20 62 79 74 65 20 54  I am a 27 byte T
00000010: 43 50 20 70 61 79 6c 6f 61 64 21                 CP payload!
```

```bash
# -g adds a space every 1 byte, which text2pcap requires
$ printf "I2019-01-01 00:00:00.000000\n" > payload.txt
$ printf "I am a 27 byte TCP payload!" | xxd -g 1 >> payload.txt
$ printf "O2019-01-01 00:02:03.456789\n" >> payload.txt
$ printf "I am a longer 34 byte TCP payload!" | xxd -g 1 >> payload.txt
$ cat payload.txt
I2019-01-01 00:00:00.000000
00000000: 49 20 61 6d 20 61 20 32 37 20 62 79 74 65 20 54  I am a 27 byte T
00000010: 43 50 20 70 61 79 6c 6f 61 64 21                 CP payload!
O2019-01-01 00:02:03.456789
00000000: 49 20 61 6d 20 61 20 6c 6f 6e 67 65 72 20 33 34  I am a longer 34
00000010: 20 62 79 74 65 20 54 43 50 20 70 61 79 6c 6f 61   byte TCP payloa
00000020: 64 21
```

```bash
$ text2pcap -4 10.0.0.1,9.9.9.9 -T 12345,80 -t "%F %T." payload.txt hello.pcap
```

--------------------------------

### Initialize Pagefind UI

Source: https://github.com/pocc/tshark.dev/blob/master/layouts/partials/search.html

Initializes the Pagefind UI with specific configuration options. Use this to customize the search experience on your website.

```javascript
window.addEventListener('DOMContentLoaded', (event) => { new PagefindUI({ element: "#pagefind-search", showSubResults: true, showImages: false, excerptLength: 15, processResult: function(result) { return result; } }); });
```

--------------------------------

### Install tshark via Package Manager

Source: https://context7.com/pocc/tshark.dev/llms.txt

Installs tshark using system package managers for Debian/Ubuntu, Arch/Fedora/CentOS, macOS, and Windows.

```bash
# Debian/Ubuntu
sudo apt install tshark
```

```bash
# Arch Linux / CentOS / Fedora / RedHat
brew install --cask wireshark
```

```bash
# Windows (Chocolatey)
choco install wireshark
```

--------------------------------

### Example PCAP Filter Conditions

Source: https://github.com/pocc/tshark.dev/blob/master/content/share/pcap_preparation.md

Examples of filter conditions for tshark. These can be used to isolate specific types of traffic or time ranges.

```bash
# If there is a dhcp problem
filter='dhcp'
# The problem is between frames 100 and 200 (inclusive)
filter='frame.number >= 100 && frame.number <= 200'
# The problem is between seconds 5 and 7 after pcap start
filter='frame.time_relative >= 5 && frame.time_relative <= 7'
```

--------------------------------

### Usage Example for Command Explanation Shortcode

Source: https://github.com/pocc/tshark.dev/blob/master/docs/PROMPT_RECOMMENDATIONS.md

Demonstrates how to use the `explain` Hugo shortcode in Markdown content to display a tshark command with its breakdown. The command is passed as a 'cmd' parameter, and the explanation follows in the shortcode body.

```markdown
{{</* explain cmd="tshark -r capture.pcap -Y 'tcp.analysis.retransmission' -T fields -e frame.number -e ip.src -e ip.dst -e tcp.srcport" */>}}
- `-r capture.pcap` — Read from file instead of live capture
- `-Y 'tcp.analysis.retransmission'` — Display filter: only show TCP retransmissions
- `-T fields` — Output as tab-separated fields (not full packet decode)
- `-e frame.number` — Print frame number
- `-e ip.src -e ip.dst` — Print source and destination IP
- `-e tcp.srcport` — Print source TCP port
{{</* /explain */>}}
```

--------------------------------

### Example Capture Filter: ICMP or TCP Port 80

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/capture_filters.md

This example demonstrates how to capture either ICMP (ping) traffic or TCP traffic on port 80 using tshark.

```bash
tshark -f "icmp or tcp port 80"
```

--------------------------------

### Combine and reorder pcaps recursively

Source: https://github.com/pocc/tshark.dev/blob/master/content/edit/mergecap.md

This example first finds all files recursively in a directory, then uses 'reordercap' to reorder packets within each file before merging them with 'mergecap'. This preempts potential issues with out-of-order packets in the source captures.

```bash
find /path/to/dir -type f -maxdepth 2 \
  | xargs -I"{}" reordercap "{}" "{}" \
  | xargs mergecap -w merged.pcapng
```

--------------------------------

### Use a Specific Configuration Profile

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/tshark.md

The -C option loads a specific configuration profile. Profiles can define default settings for various options, simplifying complex command lines.

```sh
tshark -C "MyProfile"
```

--------------------------------

### Example Display Filter: ICMP Response Not Found

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/capture_filters.md

This example shows how to use a display filter with tshark to find ICMP packets that did not receive a response. This functionality is not possible with capture filters.

```bash
tshark -r file.pcap -Y "icmp.resp_not_found"
```

--------------------------------

### Send Ping with Scapy (Python)

Source: https://github.com/pocc/tshark.dev/blob/master/content/packetcraft/scripting/scripted_gen.md

Sends an ICMP ping packet with custom data to 8.8.8.8 and saves the request/reply to 'ping.pcap'. Requires Scapy to be installed (`pip install scapy`). Data must be included for checksum calculation.

```python
# send_ping.py
from scapy.all import *
ans, unans = sr(IP(dst="8.8.8.8")/ICMP()"Scapy is easy!")
# Write the ping and its reply to a file
wrpcap("ping.pcap",ans+unans)

```

--------------------------------

### Clone tshark.dev Repository

Source: https://github.com/pocc/tshark.dev/blob/master/README.md

Download the project repository to your local machine. This is the first step to serving the site locally.

```bash
git clone https://github.com/pocc/tshark.dev
cd tshark.dev
```

--------------------------------

### Initialize Pagefind UI with Custom Options

Source: https://github.com/pocc/tshark.dev/blob/master/layouts/partials/pagefind-search.html

Instantiate the Pagefind UI with specific configurations like element targeting, result display options, and custom result processing. This code should be placed within a DOMContentLoaded event listener to ensure the DOM is ready.

```javascript
window.addEventListener('DOMContentLoaded', (event) => { new PagefindUI({ element: "#pagefind-search", showSubResults: true, showImages: false, excerptLength: 15, resetStyles: false, processResult: function(result) { // Customize result display if needed return result; } }); });
```

--------------------------------

### Display Tshark Help

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/tshark.md

Use the --help option to display the tshark help page, which lists all available command-line options and their descriptions. This is useful for understanding the full range of tshark's capabilities.

```sh
tshark --help
```

--------------------------------

### Modpcap File Header Example

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/sample_capture_headers.md

Hexadecimal representation of the header for the modpcap capture file format.

```text
# modpcap File Header
00000000: 34CD B2A1 0200 0400 0000 0000 0000 0000  4...............
```

```text
00000010: 0000 0400 0100 0000                      ........
```

--------------------------------

### ERF File Header Example

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/sample_capture_headers.md

Hexadecimal representation of the header for the ERF capture file format.

```text
# erf File Header
00000000: 0000 0000 0000 0000 9B04 0130 0000 0114  ...........0....
```

```text
00000010: 1100 0000 0000 0000 0002 0008 0000 0000  ................
```

```text
00000020: 0000 0000 FF00 0004 0000 0040 0010 0032  ...........@...2
```

```text
00000030: 4475 6D70 6361 7020 2857 6972 6573 6861  Dumpcap (Wiresha
```

```text
00000040: 726B 2920 332E 302E 3320 2876 332E 302E  rk) 3.0.3 (v3.0.
```

```text
00000050: 332D 302D 6736 3133 3062 3932 6230 6563  3-0-g6130b92b0ec
```

```text
00000060: 3629 0000 FF01 0004 0000 0078 0031 0037  6).........x.1.7
```

```text
00000070: 496E 7465 6C28 5229 2043 6F72 6528 544D  Intel(R) Core(TM
```

```text
00000080: 2920 6937 2D34 3737 3048 5120 4350 5520  ) i7-4770HQ CPU
```

```text
00000090: 4020 322E 3230 4748 7A20 2877 6974 6820  @ 2.20GHz (with
```

```text
000000a0: 5353 4534 2E32 2900 0011 002E 4D61 6320  SSE4.2).....Mac
```

```text
000000b0: 4F53 2058 2031 302E 3134 2E35 2C20 6275  OS X 10.14.5, bu
```

```text
000000c0: 696C 6420 3138 4631 3332 2028 4461 7277  ild 18F132 (Darw
```

```text
000000d0: 696E 2031 382E 362E 3029 0000 FF03 0004  in 18.6.0)......
```

```text
000000e0: 0001 0050 000C 0003 656E 3000 000D 0005  ...P....en0.....
```

```text
000000f0: 5769 2D46 6900 0000 0011 002E 4D61 6320  Wi-Fi.......Mac
```

```text
00000100: 4F53 2058 2031 302E 3134 2E35 2C20 6275  OS X 10.14.5, bu
```

```text
00000110: 696C 6420 3138 4631 3332 2028 4461 7277  ild 18F132 (Darw
```

```text
00000120: 696E 2031 382E 362E 3029 0000 0000 0000  in 18.6.0)......
```

--------------------------------

### Piping Packet Sources to Wireshark

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/sources/extcap_interfaces.md

Demonstrates two common methods for piping live packet data into Wireshark from a source.

```bash
packet-source | wireshark -k -i -

# -OR-

mkfifo myfifo
packet-source > myfifo &
wireshark -k -i myfifo
```

--------------------------------

### Deconstructing an ARP Capture Example

Source: https://github.com/pocc/tshark.dev/blob/master/content/formats/pcap_deconstruction.md

This example demonstrates parsing a two-packet ARP capture by identifying the pcap header, packet headers, and the actual packet data based on lengths specified within the headers. It highlights the process of extracting 24 bytes for the pcap header, 16 bytes for each packet header, and the real packet length from the last 4 bytes of the packet header.

```text
00000000: d4c3b2a1 02000400 00000000 00000000
00000010: ffff0000 01000000 21a96241 90330400
00000020: 3c000000 3c000000 ffffffff ffff0007
00000030: 0daff454 08060001 08000604 00010007
00000040: 0daff454 18a6ac01 00000000 000018a6
00000050: ad9f0601 04000000 00020100 03020000
00000060: 05010301 21a96241 b2b40500 3c000000
00000070: 3c000000 ffffffff ffff0007 0daff454
00000080: 08060001 08000604 00010007 0daff454
00000090: 18a6ac01 00000000 000018a6 ac8d0100
000000a0: 00100001 00000000 00002043 4b414141
```

```text
1. Take 24 bytes as pcap header.

        00000000: d4c3b2a1 02000400 00000000 00000000
        00000010: ffff0000 01000000

2. Take 16 bytes as packet header

        00000010:                   21a96241 90330400
        00000020: 3c000000 3c000000

3. Real packet length (last 4 bytes) => `0x3c` => 60.
   So take 60 bytes for the ARP packet.

        00000020:                   ffffffff ffff0007
        00000030: 0daff454 08060001 08000604 00010007
        00000040: 0daff454 18a6ac01 00000000 000018a6
        00000050: ad9f0601 04000000 00020100 03020000
        00000060: 05010301

4. Take 16 bytes as packet header.

        00000060:          21a96241 b2b40500 3c000000
        00000070: 3c000000

5. Real packet length (last 4 bytes) = `0x3c` => 60.
   So take 60 bytes for the ARP packet.

        00000060:          ffffffff ffff0007 0daff454
        00000080: 08060001 08000604 00010007 0daff454
        00000090: 18a6ac01 00000000 000018a6 ac8d0100
        000000a0: 00100001 00000000 00002043 4b414141

6. We've reached the end of the file, and there are no more bytes to parse.
```

--------------------------------

### Check Protocol Availability

Source: https://github.com/pocc/tshark.dev/blob/master/content/packetcraft/arcana/reports.md

Verifies if a specific protocol is supported by Tshark before starting analysis. Returns an error if the protocol is not found.

```bash
#!/bin/bash
# Verify protocol support before analysis

check_protocol() {
    local proto=$1
    if tshark -G protocols | grep -qi "^$proto\s"; then
        return 0
    else
        echo "ERROR: Protocol '$proto' not supported" >&2
        return 1
    fi
}

# Usage
check_protocol "http2" && echo "HTTP/2 supported"
check_protocol "quic" && echo "QUIC supported"
```

--------------------------------

### Download Sample WPA2 Capture File

Source: https://github.com/pocc/tshark.dev/blob/master/content/packetcraft/add_context/tshark_decryption.md

Download and extract a sample WPA2-PSK capture file for decryption testing. This is the first step before decrypting WPA2 traffic.

```bash
# Get a sample.pcap
pcap_url="https://mrncciew.files.wordpress.com/2014/08/wpa2-psk-final.zip"
curl $pcap_url | tar -xzv
```

--------------------------------

### View PCAP with tshark

Source: https://github.com/pocc/tshark.dev/blob/master/content/share/pcap_preparation.md

Display the contents of a PCAP file using tshark. This example shows a single packet with its details.

```bash
mbp:tshark.dev rj$ tshark -r cut_short.pcap
    1   0.000000 00:0e:58:54:10:68 → Broadcast    802.11 137 Data, SN=359, FN=0, Flags=.p....F.C

tshark: The file "cut_short.pcap" appears to have been cut short in the middle of a packet.
```

--------------------------------

### Get Top Voted Commands

Source: https://github.com/pocc/tshark.dev/blob/master/docs/PROMPT_RECOMMENDATIONS.md

Retrieves a list of the top 20 most voted commands. This endpoint is cached for 60 seconds.

```APIDOC
## GET /api/top-commands

### Description
Retrieves a list of the top 20 commands ordered by their vote count.

### Method
GET

### Endpoint
/api/top-commands

### Response
#### Success Response (200)
- **results** (array) - An array of objects, where each object contains the command ID, command text, and vote count.

### Response Example
```json
[
  {
    "command_id": "unique-command-id-123",
    "command_text": "git commit -m \"Initial commit\"",
    "votes": 150
  }
]
```
```

--------------------------------

### List Available DLTs for an Interface

Source: https://github.com/pocc/tshark.dev/blob/master/content/capture/sources/_index.md

Use this command to see the Data Link Types (DLTs) supported by a specific interface. This is useful if you need to manually set the link layer type.

```bash
tshark -i ${interface} -L
```

--------------------------------

### Send ARP Frames to Tshark

Source: https://github.com/pocc/tshark.dev/blob/master/content/generation/randpkt.md

Pipe generated ARP frames to tshark for analysis. Ensure tshark is installed and accessible in your PATH.

```bash
# Send 4 ARP frames to tshark
$ randpkt -t arp -c 4 - | tshark -r -
    1   0.000000 00:00:32:25:0f:ff → Broadcast    ARP 3873 Unknown ARP opcode 0x25dc
    2   1.000000 00:00:32:25:0f:ff → Broadcast    ARP 3690 Unknown ARP opcode 0xbb97
    3   2.000000 00:00:32:25:0f:ff → Broadcast    ARP 4618 Unknown ARP opcode 0x8f78
    4   3.000000 00:00:32:25:0f:ff → Broadcast    ARP 1204 Unknown ARP opcode 0x6c41
```

--------------------------------

### Build Static Site for tshark.dev

Source: https://context7.com/pocc/tshark.dev/llms.txt

Build the static version of the tshark.dev site using Hugo and pagefind for search indexing. The output is placed in the 'public' directory.

```bash
npm run build
```