The rest of the book will focus on explaining the most interesting parameters of the tool from a totally practical standpoint.You will also learn how to decode protocols and how to get evidence of suspicious network traffic. Subsequently, you will see several alternatives to capture traffic based on network infrastructure and the goals of the network administrator.

With this guide you will learn how to get the most out of Tshark from environments lacking GUI, ideal for example in Unix/Linux servers, offering you much flexibility to identify and display network traffic.The book begins by explaining the basic theoretical concepts of Tshark and the process of data collection. Tshark is the ideal tool for professionals who wish to meet these needs, or students who want to delve into the world of networking.Instant Traffic Analysis with Tshark How-to is a practical, hands-on guide for network administrators and security officers who want to take advantage of the filtering features provided by Tshark, the command-line version of Wireshark. Having advanced knowledge in communications and protocol analysis is therefore essential to investigate and detect any of these attacks.

Malware, DoS attacks, SQLi, and data exfiltration are some of the problems that many security officers have to face every day.

Tshark display filter