Dump and analyze network traffic

-w  <outfile> | -
    Write raw packet data to outfile or to the standard output if outfile is '-'.

    NOTE: -w provides raw packet data, not text. If you want text output you need to redirect stdout
    (e.g. using '>'), don't use the -w option for this.

-f  <capture filter>
    Set the capture filter expression.

-i  <capture interface> | -
    Set the name of the network interface or pipe to use for live packet capture.

    Network interface names should match one of the names listed in "tshark -D" (described above); a
    number, as reported by "tshark -D", can also be used.  If you're using UNIX, "netstat -i" or
    "ifconfig -a" might also work to list interface names, although not all versions of UNIX support the
    -a option to ifconfig.

    If no interface is specified, TShark searches the list of interfaces, choosing the first non-loopback
    interface if there are any non-loopback interfaces, and choosing the first loopback interface if
    there are no non-loopback interfaces. If there are no interfaces at all, TShark reports an error and
    doesn't start the capture.

    Pipe names should be either the name of a FIFO (named pipe) or ``-'' to read data from the standard
    input.  Data read from pipes must be in standard libpcap format.

    Note: the Win32 version of TShark doesn't support capturing from pipes!