====== Tshark ======

===== Exemples de commandes =====

==== Simple capture ====

<code bash>
tshark -i eth0 -w capture-output.pcap
</code>

==== Lecture d'un fichier de capture ====

<code bash>
tshark -r capture-output.pcap
</code>

==== Filtre simple ====

<code bash>
tshark -i eth0 -f 'host 192.168.0.1 and port 8080'
tshark -i eth0 -f 'net 192.168.0/24 and port 8080'
</code>

==== Analyse DNS ====

<code bash>
tshark -i wlan0 -f "src port 53" -n -T fields -e dns.qry.name -e dns.resp.addr
tshark -i wlan0 -f "src port 53" -n -T fields -e frame.time -e ip.src -e ip.dst -e dns.qry.name -e dns.resp.addr
</code>

==== Analyse web ====

<code bash>
tshark -i wlan0 -Y http.request -T fields -e http.host -e http.user_agent
</code>

==== Fréquence ====

<code bash>
tshark -r example.pcap -Y http.request -T fields -e http.host -e http.user_agent | sort | uniq -c | sort -n
</code>

==== Vol de mots de passe ====

<code bash>
tshark -i wlan0 -Y 'http.request.method == POST and tcp contains "password"' | grep password
</code>

==== Extraction d'objets ====

<code bash>
tshark -nr test.pcap --export-objects smb,tmpfolder
tshark -nr test.pcap --export-objects http,tmpfolder
</code>