Re: skipping not 'usefull' ip addresses of a dns lookup

On 8/26/23 5:32=E2=80=AFAM, Erik Auerswald wrote:
> There is a CLI "version" of Wireshark called "TShark" (tshark).=20
> It is from the wireshark developers.  It provides more detailed=20
> information than tcpdump, i.e., the Wireshark protocol dissection.=20
> (I usually start with tcpdump for a first impression.  TShark provides=20
> an alternative to copying a capture file to a system with a GUI.)

I absolutely agree.

My experience is that most systems I want to capture packets on do have=20
tcpdump installed but don't have tshark installed.  Or at least at the=20
time I want to do the capture.

As such, I use tcpdump for things on system and occasionally pull=20
pcap(ng) files back to my workstation where I use Wireshark with all my=20
preferences and local name resolution information.

I have also used Wireshark's remote capability a few times where it can=20
use ssh to remotely run tcpdump on a remote system.  That's a very slick=20
feature when you take the few minutes to set it up the first time.  --=20
I did this on systems I routinely captured traffic on.  E.g. I=20
frequently have my primary workstation pre-configured to ssh into the=20
router / firewall and remotely run tcpdump to display in Wireshark=20
running on said workstation.



Grant. . . .