If the -O option is specified, it will only show the full details for the protocols specified, and show only the top-level detail line for all other protocols. If the -V option is specified, it instead writes a view of the details of the packet, showing all the fields of all protocols in the packet. When displaying packets on the standard output, TShark writes, by default, a summary line containing the fields specified by the preferences file which are also the fields displayed in the packet list pane in Wiresharkalthough if it's writing packets as it captures them, rather than writing packets from a saved capture file, it won't show the 'frame number' field. If the zlib library is not present when compiling TSharkit will be possible to compile it, but the resulting program will be unable to read compressed files. Compressed file support uses and therefore requires the zlib library. The input file doesn't need a specific filename extension the file format and an optional gzip compression will be automatically detected. TShark is able to detect, read and write the same capture files that are supported by Wireshark. When run with the -r option, specifying a capture file from which to read, TShark will again work much like tcpdumpreading packets from the file and displaying a summary line on the standard output for each packet read. It will use the pcap library to capture traffic from the first available network interface and displays a summary line on the standard output for each received packet. Without any options set, TShark will work much like tcpdump.

How to install tshark on centos install