My initial use would be determining what, if anything, is coming in to the server on one of its ethernet interfaces from my Mac on the same LAN subnet. There's a router and a switch between the Mac and the server. I'm trying to set up the server as a web proxy for the Mac.
Use tshark, the command line client.
(If I shouldn't turn this into a "newbie's questions" thread beyond the scope of my original question, please let me know.)
What's the most expedient way to access/read the pcapng files that tshark writes?
Got it -- tcpdump
tcpdump is also useful but doesn't have some of the filtering capabilities that tshark has. Use whatever's appropriate for you.
To examine the captures, transfer them to another host that can run Wireshark.
I meant tcpdump only for examining the tshark pcapng file output, after Ctrl-C-ing out of tshark.
tcpdump dissects much less traffic than tshark, but if it meets your needs it's good enough. Arguably you could also use tcpdump to make the captures.
Comments