tshark使用说明

 tshark -h
 TShark (Wireshark) 2.4. (v2.4.1--gf42a0d2b6c)
 Dump and analyze network traffic.
 See https://www.wireshark.org for more information.

 Usage: tshark [options] ...

 Capture interface:
   -i <interface>           name or idx of interface (def: first non-loopback)
   -f <capture filter>      packet filter in libpcap filter syntax

   -s <snaplen>             packet snapshot length (def: appropriate maximum)
   -p                       don't capture in promiscuous mode
   -I                       capture in monitor mode, if available
   -B <buffer size>         size of kernel buffer (def: 2MB)
   -y <link type>           link layer type (def: first appropriate)
   -D                       print list of interfaces and exit
   -L                       print list of link-layer types of iface and exit

 Capture stop conditions:
   -c <packet count>        stop after n packets (def: infinite)
   -a <autostop cond.> ...  duration:NUM - stop after NUM seconds
                            filesize:NUM - stop this file after NUM KB
                               files:NUM - stop after NUM files
 Capture output:
   -b <ringbuffer opt.> ... duration:NUM - switch to next file after NUM secs
                            filesize:NUM - switch to next file after NUM KB
                               files:NUM - ringbuffer: replace after NUM files
 RPCAP options:
   -A <user>:<password>     use RPCAP password authentication

 Input file:
   -r <infile>              set the filename to read from (- to read from stdin)

 Processing:
   -                       perform a two-pass analysis
   -M <packet count>        perform session auto reset
   -R <read filter>         packet Read filter in Wireshark display filter syntax

                            (requires -)
   -Y <display filter>      packet displaY filter in Wireshark display filter
                            syntax
   -n                       disable all name resolutions (def: all enabled)
   -N <name resolve flags>  enable specific name resolution(s): "mnNtCd"
   -d <layer_type>==<selector>,<decode_as_protocol> ...
                            "Decode As", see the man page for details
                            Example: tcp.port==,http
   -H <hosts file>          read a list of entries from a hosts file, which will
                            then be written to a capture file. (Implies -W n)
   --enable-protocol <proto_name>
                            enable dissection of proto_name
   --disable-protocol <proto_name>
                            disable dissection of proto_name
   --enable-heuristic <short_name>
                            enable dissection of heuristic protocol
   --disable-heuristic <short_name>
                            disable dissection of heuristic protocol
 Output:
   -w <outfile|->           write packets to a pcap-format file named "outfile"
                            (or to the standard output for "-")
   -C <config profile>      start with specified configuration profile
   -F <output file type>    set the output file type, default is pcapng
                            an empty "-F" option will list the file types
   -V                       add output of packet tree        (Packet Details)
   -O <protocols>           Only show packet details of these protocols, comma
                            separated
   -P                       print packet summary even when writing to a file
   -S <separator>           the line separator to print between packets
   -x                       add output of hex and ASCII dump (Packet Bytes)
   -T pdml|ps|psml|json|jsonraw|ek|tabs|text|fields|?
                            format of text output (def: text)
   -j <protocolfilter>      protocols layers filter if -T ek|pdml|json selected
                            (e.g. "ip ip.flags text", filter does not expand chil
 d
                            nodes, unless child is specified also in the filter)
   -J <protocolfilter>      top level protocol filter if -T ek|pdml|json selected

                            (e.g. "http tcp", filter which expands all child node
 s)
   -e <field>               field to print if -Tfields selected (e.g. tcp.port,
                            _ws.col.Info)
                            this option can be repeated to print multiple fields
   -E<fieldsoption>=<value> set options for output when -Tfields selected:
      bom=y|n               print a UTF- BOM
      header=y|n            switch headers on and off
      separator=/t|/s|<char> select tab, space, printable character as separator
      occurrence=f|l|a      print first, last or all occurrences of each field
      aggregator=,|/s|<char> select comma, space, printable character as
                            aggregator
      quote=d|s|n           select double, single, no quotes for values
   -t a|ad|d|dd|e|r|u|ud|?  output format of time stamps (def: r: rel. to first)
   -u s|hms                 output format of seconds (def: s: seconds)
   -l                       flush standard output after each packet
   -q                       be more quiet on stdout (e.g. when using statistics)
   -Q                       only log true errors to stderr (quieter than -q)
   -g                       enable group read access on the output file(s)
   -W n                     Save extra information in the file, if supported.
                            n = write network address resolution information
   -X <key>:<value>         eXtension options, see the man page for details
   -U tap_name              PDUs export mode, see the man page for details
   -z <statistics>          various statistics, see the man page for details
   --capture-comment <comment>
                            add a capture comment to the newly created
                            output file (only for pcapng)
   --export-objects <protocol>,<destdir> save exported objects for a protocol to
                            a directory named "destdir"

 Miscellaneous:
   -h                       display this help and exit
   -v                       display version info and exit
   -o <name>:<value> ...    override preference setting
   -K <keytab>              keytab file to use for kerberos decryption
   -G [report]              dump one of several available reports and exit
                            default report="fields"
                            use "-G ?" for more help

---

 tshark.exe -F
 tshark.exe: option requires an argument -- 'F'
 tshark: The available capture file types for the "-F" flag are:
     5views - InfoVista 5View capture
     btsnoop - Symbian OS btsnoop
     commview - TamoSoft CommView
     dct2000 - Catapult DCT2000 trace (.out format)
     erf - Endace ERF capture
     eyesdn - EyeSDN USB S0/E1 ISDN trace format
     k12text - K12 text file
     lanalyzer - Novell LANalyzer
     logcat - Android Logcat Binary format
     logcat-brief - Android Logcat Brief text format
     logcat-long - Android Logcat Long text format
     logcat-process - Android Logcat Process text format
     logcat-tag - Android Logcat Tag text format
     logcat-thread - Android Logcat Thread text format
     logcat-threadtime - Android Logcat Threadtime text format
     logcat-time - Android Logcat Time text format
     modpcap - Modified tcpdump - pcap
     netmon1 - Microsoft NetMon .x
     netmon2 - Microsoft NetMon .x
     nettl - HP-UX nettl trace
     ngsniffer - Sniffer (DOS)
     ngwsniffer_1_1 - NetXray, Sniffer (Windows) 1.1
     ngwsniffer_2_0 - Sniffer (Windows) .00x
     niobserver - Network Instruments Observer
     nokiapcap - Nokia tcpdump - pcap
     nsecpcap - Wireshark/tcpdump/... - nanosecond pcap
     nstrace10 - NetScaler Trace (Version 1.0)
     nstrace20 - NetScaler Trace (Version 2.0)
     nstrace30 - NetScaler Trace (Version 3.0)
     nstrace35 - NetScaler Trace (Version 3.5)
     pcap - Wireshark/tcpdump/... - pcap
     pcapng - Wireshark/... - pcapng
     rf5 - Tektronix K12xx -bit .rf5 format
     rh6_1pcap - RedHat 6.1 tcpdump - pcap
     snoop - Sun snoop
     suse6_3pcap - SuSE 6.3 tcpdump - pcap
     visual - Visual Networks traffic capture

---

 tshark -i4 -c  -f "tcp" -F pcap -w c:\test.pcap
 tshark -i4 -a duration: -f "tcp" -F pcap -w e:\test.pcap