Summarize TCP conversations from a capture
Build a paste-ready command, then review its compatibility and effects before running it.
tshark -r capture.pcapng -q -z conv,tcpread-onlyno known side effects Compatibility
LinuxVerified for Linux using posix, bash, zsh syntax.
Operational knowledgereview due 2027-01-20
Requirementstsharktshark must be installed and available on PATH.
Version supporttshark Current supported releasesVerified for linux using posix, bash, zsh syntax; consult compatibility notes for platform-specific differences.
Expected signalsTCP ConversationsRepresentative successful output; values vary with the selected target and system state.
Known errorstshark: command not foundtshark is missing or is not available on PATH.
Verifytshark -r capture.pcapng -q -z conv,tcpThe output matches the expected target and exits without an error.Rollback noteNot required: this command is read-only and does not change system state.
Command breakdown
01tsharkCommandRuns the tshark stage of this one-liner.
02-rOptionEnables raw, recursive, or reverse mode for this command.
03capture.pcapngArgumentPasses capture.pcapng to tshark.
04-qOptionConfigures tshark with the -q option.
05-zOptionConfigures tshark with the -z option.
06conv,tcpArgumentPasses conv,tcp to tshark.
Example input
tshark -r capture.pcapng -q -z conv,tcp
Example output
TCP Conversations
192.0.2.20:44118 <-> 192.0.2.10:443 42 31 kB 38 28 kB 80 59 kB 2.1040
Illustrative output — exact values vary by system and data.
Official sources