1
sudo apt install wireshark tshark
2
# sudo dpkg-reconfigure wireshark-common # Yes
3
sudo usermod -aG wireshark $USER
4

5

6
sudo chgrp wireshark /usr/bin/dumpcap
7
sudo chmod 750 /usr/bin/dumpcap
8
sudo setcap cap_net_raw,cap_net_admin=eip /usr/bin/dumpcap
9

10
tshark -D # 列出可用网络接口
11

12
tshark -i eth0 -w output.pcap
13
tshark -r output.pcap         # 读取和分析已保存的抓包文件
14
tshark -r output.pcap -Y "ip.src == 192.168.1.100 and ip.dst == 192.168.1.102 and tcp.port == 80"
15

16
tshark -i eth0 -f "tcp port 80 and (src host 192.168.1.100 or src host 192.168.1.102)"
17
tshark -i eth0 -f "tcp port 80 and src net 192.168.1.0/24"
18
tshark -i eth0 -Y "http"