From fd7ba91b4ad3f3d30331c21890e2d5e310252633 Mon Sep 17 00:00:00 2001
From: Omar Santos <santosomar@gmail.com>
Date: Fri, 27 Mar 2020 16:55:19 -0400
Subject: [PATCH] Create tshark-cheat-sheet.md

---
 cheat_sheets/tshark-cheat-sheet.md | 34 ++++++++++++++++++++++++++++++
 1 file changed, 34 insertions(+)
 create mode 100644 cheat_sheets/tshark-cheat-sheet.md

diff --git a/cheat_sheets/tshark-cheat-sheet.md b/cheat_sheets/tshark-cheat-sheet.md
new file mode 100644
index 0000000..96cd8cb
--- /dev/null
+++ b/cheat_sheets/tshark-cheat-sheet.md
@@ -0,0 +1,34 @@
+# Tshark Cheat Sheet
+
+
+## Capture Packets with Tshark
+```
+tshark -i eth0 -w capture-file.pcap
+```
+## Read a Pcap with Tshark
+```
+tshark -r capture-file.pcap
+```
+
+## Filtering Packets from One Host
+```
+tshark -i eth0 -p -w capture-file.cap host 10.1.2.3
+```
+
+## HTTP Analysis with Tshark
+The `-T` option specifies that we want to extract fields and with the `-e` options we identify which fields we want to extract.
+
+```
+tshark -i eth0 -Y http.request -T fields -e http.host -e http.user_agent
+```
+## Manipulating other Fields
+
+This command will extract files from an SMB stream and extract them to the location tmpfolder.
+```
+tshark -nr test.pcap --export-objects smb,tmpfolder
+```
+
+This command will do the same except from HTTP, extracting all the files seen in the pcap.
+```
+tshark -nr test.pcap --export-objects http,tmpfolder
+```