SHARKD(1)

📦
version 4.7.4 · 5 versions
, in arch rolling

💖 SHARKD(1) 💖

okay so bestie, welcome to SHARKD(1) — the manual page for sharkd, the daemon version of Wireshark that speaks JSON. this is part 1, so like, hydrate and get comfy 💅

✨ NAME ✨

sharkd — dump and analyze network traffic interactively, but make it JSON-RPC 🦋

✨ SYNOPSIS ✨

sharkd [ -a|--api <socket> ] [ --foreground ]
[ -C|--config-profile <configuration profile> ]

sharkd -

sharkd -h|--help

sharkd -v|--version

✨ DESCRIPTION ✨

so sharkd is literally the daemon-flavored variant of Wireshark, and it hands you a JSON-based API for doing network protocol analysis. it runs on the same dissection engine as Wireshark and TShark, which means you get programmatic access to packet dissection, filtering, and analysis. no cap, it's the same brain, just a different vibe 🔥

sharkd can live in two modes: console mode and daemon mode.

  • In console mode, sharkd reads JSON-RPC requests from standard input and writes responses to standard output. you activate this by passing - as the argument, or by just running sharkd without the -a option. main character energy, no socket needed ✨
  • In daemon mode, sharkd listens on a Unix domain socket or a TCP socket for incoming connections, and forks a new session process for each client. you activate this by passing the -a option with a socket specification 👑

Requests and responses are encoded as JSON objects, one per line. peep the JSON-RPC METHODS section below for the complete list of method calls 🎀

for full details on the JSON-RPC API, see https://wiki.wireshark.org/Development/sharkd.

⚠️ Warning — sharkd should not be exposed to untrusted users. Unfiltered access to sharkd could potentially result in information disclosure or arbitrary command execution. like, genuinely, do not do this. i'm serious 😭 keep it locked down.

🌸 OPTIONS 🌸

  • -a <socket>, --api <socket> — listen on the specified socket for incoming client connections instead of reading from the console. when you use this option, sharkd runs as a daemon and forks a new session process for each client connection 🧚

Supported socket types:

  • unix:path — listen on a Unix domain socket at path. for example, unix:/tmp/sharkd.sock. on Linux, abstract sockets are supported by prefixing the name with @, for example unix:@sharkd; abstract sockets only support connections from peers with the same effective UID. Unix domain sockets are available on Windows 10 version 1803 and later, including Windows Server 2019 💜
  • tcp:address:port — listen on a TCP socket bound to address on port. for example, tcp:127.0.0.1:4446. for IPv6 addresses, enclose the address in square brackets, e.g. tcp:[[::1]:5678. for security reasons, TCP sockets are only available on Windows builds by default, and only loopback addresses are supported, i.e. an IPv4 address in the 127.0.0.0/8 address space or the ::1 IPv6 loopback address 🔒

If no -a option is provided, or if sharkd - is used, sharkd will accept commands via the console (standard input) 🫶

  • --foreground — when running in daemon mode, do not detach from the controlling terminal. by default, sharkd forks into the background when a socket is specified with the -a option. perfect for when you wanna keep an eye on it 👀
  • -C <configuration profile>, --config-profile <configuration profile> — start with the specified configuration profile 🎀
  • -h, --help — print the version number and options and exit. the classic escape hatch 💫
  • -v, --version — print the full version information and exit ⭐

🩺 DIAGNOSTIC OPTIONS 🩺

  • --log-level <level> — set the active log level. supported levels, in lowest to highest order, are "noisy", "debug", "info", "message", "warning", "critical", and "error". messages at each level and higher will be printed — for example, "warning" prints "warning", "critical", and "error" messages, and "noisy" prints all messages. levels are case insensitive 💅
  • --log-fatal <level> — abort the program if any messages are logged at the specified level or higher. for example, "warning" aborts on any "warning", "critical", or "error" messages 💀
  • --log-fatal-count <count> — the amount of fatal log messages which may pass before the program is aborted 🍓
  • --log-domains <list> — only print messages for the specified log domains, e.g. "GUI,Epan,sshdump". the list of domains must be comma-separated. can be negated with "!" as the first character (inverts the match) 🌈
  • --log-debug <list> — force the specified domains to log at the "debug" level. the list of domains must be comma-separated. can be negated with "!" as the first character (inverts the match) 🦋
  • --log-noisy <list> — force the specified domains to log at the "noisy" level. the list of domains must be comma-separated. can be negated with "!" as the first character (inverts the match) 🌸
  • --log-fatal-domains <list> — abort the program if any messages are logged for the specified log domains. the list of domains must be comma-separated 😤
  • --log-file <path> — write log messages and stderr output to the specified file 📝

🎀 JSON-RPC METHODS 🎀

sharkd accepts newline-delimited JSON-RPC requests. every single request must include a jsonrpc field set to "2.0", a method field, and an id field. the following methods are supported, bestie:

  • analyse — analyse the loaded capture file and return summary information ✨
  • bye — terminate the session 👋
  • check — check or compile a display filter 🔍
  • complete — provide field name completion suggestions 💭
  • download — download captured data or reassembled objects ⬇️
  • dumpconf — dump current preference values 🗂️
  • field — get information about a specific display filter field 🎯
  • fields — list all available display filter fields 📋
  • follow — follow a stream (TCP, UDP, HTTP, etc.) 🧵
  • frame — get detailed information about a specific frame 🖼️
  • frames — get a list of frames (packets) from the loaded capture file 📦
  • info — get information about available dissectors, taps, and statistics ℹ️
  • intervals — get frame interval data for the loaded capture file ⏱️
  • iograph — get I/O graph data for the loaded capture file 📈
  • load — load a capture file for analysis 📂
  • setcomment — set a comment on a specific frame 💬
  • setconf — set a Wireshark preference value ⚙️
  • status — get the status of the currently loaded capture file 🚦
  • tap — run a tap on the loaded capture file 🚰

🌟 EXAMPLES 🌟

to run sharkd in console mode:

sharkd -

to run sharkd as a daemon listening on a Unix domain socket:

sharkd -a unix:/tmp/sharkd.sock

to run sharkd as a daemon with a specific configuration profile:

sharkd -a unix:/tmp/sharkd.sock -C myprofile

to keep the daemon in the foreground for debugging:

sharkd -a unix:/tmp/sharkd.sock --foreground

an example console session, loading a file and getting its status:

$ echo '{"jsonrpc":"2.0","id":1,"method":"load","params":{"file":"/path/to/capture.pcapng"}}' | sharkd -
$ echo '{"jsonrpc":"2.0","id":2,"method":"status"}' | sharkd -

and that's a wrap on part 1, babes 💖 more is coming, don't go anywhere 🫶

🌸 ENVIRONMENT VARIABLES 🌸

Okay bestie, these are the lil knobs you can flip in your shell before you even launch sharkd. Set them, export them, live your truth ✨

  • WIRESHARK_CONFIG_DIR — this one overrides where your personal config files live. On UNIX-compatible systems (Linux, macOS, *BSD, Solaris, and AIX), it defaults to $XDG_CONFIG_HOME/wireshark — or, if that directory doesn't exist but $HOME/.wireshark does exist, then $HOME/.wireshark. Which is typically $HOME/.config/wireshark. On Windows it defaults to %APPDATA%\Wireshark (or, if %APPDATA% isn't defined, %USERPROFILE%\Application Data\Wireshark). Available since Wireshark 3.0. 🗂️
  • WIRESHARK_DEBUG_WMEM_OVERRIDE — set this and you force the wmem framework to use whatever allocator backend you name, for all allocations, no matter which backend the code normally asked for. Basically a dev-only toy for testing and debugging. See README.wmem in the source distribution for the deets. 🧪
  • WIRESHARK_RUN_FROM_BUILD_DIRECTORY — this makes plugins and other data files load from the build directory (the place where the program got compiled) instead of the standard locations. It does nothing when the program in question is running with root (or setuid) permissions on UNIX-compatible systems such as Linux, macOS, *BSD, Solaris, and AIX. 🏗️
  • WIRESHARK_DATA_DIR — makes all the various data files load from a directory that isn't the standard locations. Again, zero effect when the program is running with root (or setuid) permissions on UNIX-compatible systems. 📁
  • WIRESHARK_EXTCAP_DIR — makes the various extcap programs and scripts run from a directory other than the standard locations. Same deal: no effect when running with root (or setuid) permissions on UNIX-compatible systems. 🔌
  • WIRESHARK_PLUGIN_DIR — makes the various plugins load from a directory other than the standard locations. And yes, no effect when running with root (or setuid) permissions on UNIX-compatible systems. 🧩
  • ERF_RECORDS_TO_CHECK — controls how many ERF records get checked when deciding if a file really is in ERF format. Set it higher than the default (20) and false positives become less likely. 🕵️‍♀️
  • IPFIX_RECORDS_TO_CHECK — same energy but for IPFIX: controls how many IPFIX records get checked when deciding if a file really is in IPFIX format. Higher than the default (20) = fewer false positives. 🎯
  • WIRESHARK_ABORT_ON_DISSECTOR_BUG — set this and TShark will call abort(3) the moment a dissector bug shows up. abort(3) makes the program exit abnormally; if you've got TShark running in a debugger it should halt right there in the debugger so you can inspect the process, and if you're not in a debugger it'll generate a core dump file on some OSes (assuming your environment is configured correctly). Super useful for devs troubleshooting a protocol dissector problem. 💥
  • WIRESHARK_ABORT_ON_TOO_MANY_ITEMS — set this and TShark calls abort(3) if a dissector tries to add too many items to a tree (which generally means the dissector didn't break out of a loop soon enough). Same abort(3) behaviour: abnormal exit, halts in the debugger if you're running under one, and on some OSes — assuming your environment is configured correctly — generates a core dump file. Also great for devs troubleshooting a protocol dissector. 🌀
  • WIRESHARK_LOG_LEVEL — controls how chatty the diagnostic messages to the console are. From least to most verbose, the levels are critical, warning, message, info, debug, or noisy. Levels above the current level are also active. Levels critical and error are always active. 🗣️
  • WIRESHARK_LOG_FATAL — sets the fatal log level. Fatal log levels cause the program to abort. This level can be set to Error, critical, or warning. Error is always fatal and is the default. ☠️
  • WIRESHARK_LOG_DOMAINS — picks which log domains are active. The filter is a case-insensitive comma separated list. If it's set, only the included domains get enabled. The default domain is always considered enabled. Domain filter lists can be preceded by ! to invert the sense of the match. 🔀
  • WIRESHARK_LOG_DEBUG — a list of domains with debug log level. This sets the level of the provided log domains and takes precedence over the active domains filter. Preceded by !? Then it disables the debug level instead. 🐛
  • WIRESHARK_LOG_NOISY — literally the same as above but for the noisy log level instead. 📢

🔎 SEE ALSO 🔎

Go read these too, they're the whole friend group 💖

wireshark-filter(4), wireshark(1), editcap(1), pcap(3), dumpcap(1), text2pcap(1), mergecap(1), pcap-filter(7) or tcpdump(8)

📝 NOTES 📝

This is the manual page for Sharkd 4.7.4. Sharkd is part of the Wireshark distribution. The latest version of Wireshark can be found at https://www.wireshark.org. 🌐

HTML versions of the Wireshark project man pages are available at https://www.wireshark.org/docs/man-pages. 🫶

👑 AUTHORS 👑

Sharkd was written by Jakub Zawadzki. Sharkd uses the same packet dissection code that Wireshark does, as well as using many other modules from Wireshark; see the list of authors in the Wireshark man page for a list of authors of that code. ✨

And that's the whole page, bestie!! 🎀 This beauty is Sharkd 4.7.4, dated 2026-10-08, and it ate, no cap. Go dissect something iconic 💅🔥

📦 where this page comes from