Skip to content
Switch branches/tags

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

TCPShark (WIP)

tcpshark is a tcpdump-like utility, with an extra feature: it stores the process id, the command and the arguments as a trailer for each Ethernet frame. For now, only TCP and UDP Ethernet packets are supported.

Tested on recent versions of Linux, Mac and Windows.

libpcap or equivelant (npcap for Windows) is required.


The trailer can be parsed via the lua script tcpshark.lua, which can be added to wireshark's plugin system, or directly injected in each run via -X option in wireshark (look below for examples). There's also an excellent video on loading custom dissectors for Wireshark here:

Wireshark Custom Dissectors


  tcpshark [OPTIONS]

  -o, --outfile=         Output pcap file path. Use '-' for stdout
  -i, --interface=       Interface to use. Only supports Ethernet type packets interfaces. Do not use it on SPANs (default: lo)
  -f, --bpf=             tcpdump-style BPF filter
  -v, --verbosity=       Verbosity of the metadata: 0 - only pid, 1 - pid and cmd, 2 - pid, cmd and args (default: 1)
  -l, --list-interfaces  List available interfaces and exit
  -d, --lua-dissector    Print the Lua dissector used in Wireshark

Help Options:
  -h, --help             Show this help message

Live capture in local system

git clone
cd tcpshark
go get
go build .
sudo ./tcpshark -i eth0 -o - -v 2 | wireshark -X lua_script:tcpshark.lua -Y tcpshark -k -i -

Live capture through SSH

scp tcpshark HOSTNAME:/tmp/tcpshark
ssh HOSTNAME sudo /tmp/tcpshark -i eth0 -o - -v 2 --bpf="'not port 22'" | wireshark -X lua_script:tcpshark.lua -Y tcpshark -k -i -

Offline pcap

sudo ./tcpshark -i eth0 -o /tmp/test.pcapng