Text2pcap generates a capture file from an ASCII hexdump of packets

Reordercap reorder input file by timestamp into output file Rawshark dump and analyze raw libpcap data

Mergecap merges multiple capture files into one For long-term capturing, this is the tool you want.Įditcap edit and/or translate the format of capture files Dumpcap is the engine under the Wireshark/tshark hood. These tools are useful to work with capture files.Ĭapinfos is a program that reads a saved capture file and returns any or all of several statistics about that fileĭumpcap a small program whose only purpose is to capture network traffic, while retaining advanced features like capturing to multiple files (since version 0.99.0). Some command line tools are shipped together with Wireshark. Intrusion Analysis / SQL Database Support.Capture file editors and/or anonymizers.It is useful to automatically restart the container on failures using the -restart unless-stopped parameter. The default password is wireshark, but can be changed by setting the environment variable XPRA_PASSWORD.Įxisting network traces can be uploaded to the container by drag & drop onto the Wireshark window. If you want to specify your own certificate, you can overwrite the default SSL certificate with the docker parameter similar to -mount type=bind,source='$(pwd)'/ssl-cert.pem,target=/etc/xpra/ssl-cert.pem,readonly (make sure to put the ssl-cert.pem file in the current folder or modify the source path).īy default, Wireshark can only be accessed using a password. When using -net host to run the container as part of the host network, then published ports will be ignored and you need to make sure that port 14500 is accessible on your host and not blocked via firewall.īy default, the container uses the default self-signed certificate to offer SSL. 5432/14500).īy default it should be sufficient to use the parameter -cap-add NET_ADMIN to allow Wireshark to capture traffic, but if Wireshark does not show any interfaces for capturing or shows permission errors, docker must be run with the parameter -privileged which grants extended privileges to the container but should be avoided if possible for security reasons. Change docker port mapping to a different port if required (e.g. Docker image which makes Wireshark available via Web browser using XPRA.

Wireshark cli