Wireshark

wireshark -i eth0
wireshark -i eth0 -k                 # Start capture immediately
wireshark -i eth0 -w capture.pcap    # Save to file

tshark -i eth0
tshark -i eth0 -w capture.pcap
tshark -r capture.pcap

http
dns
tcp
udp
smb
smb2
ftp
ssh
telnet
icmp
arp

ip.addr == 10.10.10.10
ip.src == 10.10.10.10
ip.dst == 10.10.10.10
!(ip.addr == 10.10.10.10)

tcp.port == 80
tcp.dstport == 443
udp.port == 53

tcp.flags.syn == 1
tcp.flags.reset == 1
tcp.flags.fin == 1
tcp.flags.syn == 1 && tcp.flags.ack == 0    # SYN only

ip.addr == 10.10.10.10 && tcp.port == 80
http.request.method == "POST"
http.response.code == 200
dns.qry.name contains "target"

host 10.10.10.10
port 80
src host 10.10.10.10
dst port 443
net 10.10.10.0/24
tcp port 80 and host 10.10.10.10

tshark -r capture.pcap -z follow,tcp,ascii,0

http.authbasic

ftp.request.command == "USER" || ftp.request.command == "PASS"

telnet

ntlmssp

smtp.req.command == "AUTH"

tshark -r capture.pcap --export-objects http,./exported/
tshark -r capture.pcap --export-objects smb,./exported/

# Extract HTTP URLs
tshark -r capture.pcap -Y "http.request" -T fields -e http.host -e http.request.uri

# Extract DNS queries
tshark -r capture.pcap -Y "dns.flags.response == 0" -T fields -e dns.qry.name

# Extract credentials
tshark -r capture.pcap -Y "http.authbasic" -T fields -e http.authbasic