At first I thought it can be easily found by 'ipconfig' But if you have multiple network card (including WiFi), you need to know the exact name of the interface card. If you have only one network interface card in the PC, you don't need to know. One of the most important parameter you have to specify in 'Tshark' command would be the name of your network interface card. So don't blindly copy this and search the location on PC/equipment yourself). (but you may find this in different location. In my PC, I found the wireshark in the following folder. The simplest way to find the location of Tshark is to search 'Tshark' in windows file explorer. 'tashark' is not recognized as an internal or external command, operable program or batch file. (In most case, if you just type in 'Tshark' in the command window, you may see following message). The first thing you need to know is the location (folder) of Tshark executable program. How to start capturing the packets for a specific interface into a pcap file in a certain file size ?.How to start capturing the packets for a specific interface into a pcap file for a certain duration ?.How to start capturing the packets for a specific interface into a pcap file ?.How to start capturing the packets for a specific interface Number(index) ?.How to start capturing the packets for a specific interface Name ?.You may use this page as a cheatsheet for these commands. The only issue is to figure out proper command and option keys. You can do in Tshark whatever you can do in Wireshark. Simply put, Tshark is the command line version of wireshark.

Tshark pcap