When you are debugging a complex networking issue—such as a database connection constantly dropping or an API failing to authenticate—basic tools like ping and netstat are insufficient. You need to physically capture the raw data packets flying across the network wire to see exactly what the servers are saying to each other. While Wireshark is the industry-standard graphical tool for this, you cannot run a graphical interface on a headless Linux server. Instead, you must use tshark, the incredibly powerful, command-line terminal equivalent of Wireshark.
How to Capture Basic Network Traffic
Because tshark interacts directly with your server’s Network Interface Card (NIC) at a microscopic level, you must execute it with root privileges. You can install it on Debian/Ubuntu systems via sudo apt install tshark.
To begin a live, unfiltered packet capture on your primary network interface, simply run:
sudo tsharkThe terminal will instantly explode with scrolling data. Every single line represents a physical packet moving into or out of your server. You will see the Source IP, the Destination IP, the specific Protocol being used (e.g., TCP, UDP, TLS), and a brief summary of the packet’s payload. To stop the capture and regain control of your terminal, press Ctrl + C.
Filtering Traffic by Port and Protocol
A live, unfiltered capture on a busy web server is completely unreadable. You must apply strict “capture filters” to force tshark to ignore the noise and only record the specific traffic you care about.
If you are troubleshooting an issue with your web server and only want to capture HTTP (port 80) and HTTPS (port 443) traffic, you use the -f (filter) flag.
sudo tshark -f "port 80 or port 443"If you want to completely ignore web traffic and focus solely on the communication between your server and a specific backend database (e.g., an IP address of 10.0.0.5), you can filter by host:
sudo tshark -f "host 10.0.0.5"Saving Captures for Wireshark Analysis
While reading summary lines in the terminal is helpful for quick checks, deep forensic analysis requires looking at the actual hexadecimal payload of the packets. The best way to do this is to use tshark to silently record the traffic into a standard .pcap file, which you can later download to your laptop and open in the graphical Wireshark application.
To capture exactly 1,000 packets and save them to a file named capture.pcapng, use the -w (write) and -c (count) flags:
sudo tshark -c 1000 -w capture.pcapngThe command will run silently in the background. Once it successfully intercepts 1,000 packets, it will safely close the file and exit, leaving you with a forensic-grade network capture ready for analysis.