rpsa/remote-tshark repository overview

docker run --rm -it \
  --cap-add NET_ADMIN \
  --cap-add NET_RAW \
  rpsa/remote-tshark \
  tshark -i rpcap://192.168.2.2:2002/eth1 -f udp

# =========================
# Builder
# =========================
FROM --platform=$TARGETPLATFORM debian:bookworm AS builder

ARG TARGETPLATFORM
ARG TARGETARCH
ARG WIRESHARK_VERSION=4.2.7
ARG LIBPCAP_VERSION=1.10.5

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates curl xz-utils \
    build-essential cmake ninja-build pkg-config \
    flex bison \
    libglib2.0-dev zlib1g-dev libpcre2-dev libzstd-dev libgcrypt20-dev \
    libmaxminddb-dev libnghttp2-dev libc-ares-dev ccache \
    libspeexdsp-dev \
  && rm -rf /var/lib/apt/lists/*

WORKDIR /opt/src

# ---- libpcap (tarball con configure) ----
RUN curl -fsSL https://www.tcpdump.org/release/libpcap-${LIBPCAP_VERSION}.tar.gz -o /tmp/libpcap.tar.gz \
 && tar -xzf /tmp/libpcap.tar.gz -C /opt/src \
 && cd /opt/src/libpcap-${LIBPCAP_VERSION} \
 && ./configure --enable-remote --prefix=/usr/local \
 && make -j"$(nproc)" \
 && make install

# ---- Wireshark/TShark (tarball) ----
RUN curl -fsSL https://www.wireshark.org/download/src/all-versions/wireshark-${WIRESHARK_VERSION}.tar.xz -o /tmp/wireshark.tar.xz \
 && tar -xf /tmp/wireshark.tar.xz -C /opt/src \
 && mkdir -p /opt/src/wireshark-${WIRESHARK_VERSION}/build

WORKDIR /opt/src/wireshark-${WIRESHARK_VERSION}/build
RUN cmake -G Ninja .. \
  -DCMAKE_BUILD_TYPE=Release \
  -DCMAKE_INSTALL_PREFIX=/usr/local \
  -DBUILD_wireshark=OFF \
  -DBUILD_qtshark=OFF \
  -DBUILD_tshark=ON \
  -DENABLE_REMOTE=ON \
  -DENABLE_PLUGINS=OFF \
  -DENABLE_GNUTLS=OFF \
  -DENABLE_KERBEROS=OFF \
  -DENABLE_LUA=OFF \
  -DENABLE_LIBXML2=OFF \
  -DENABLE_OPUS=OFF \
  -DENABLE_SPEEXDSP=ON \
  -DENABLE_ILBC=OFF \
  -DENABLE_GIT=ON \
  -DPCAP_INCLUDE_DIR=/usr/local/include \
  -DPCAP_LIBRARY=/usr/local/lib/libpcap.a

RUN ninja -j"$(nproc)" && ninja install \
 && strip --strip-unneeded /usr/local/bin/tshark /usr/local/bin/dumpcap || true

# =========================
# Runtime
# =========================
FROM debian:bookworm-slim AS runtime

ENV DEBIAN_FRONTEND=noninteractive
RUN apt-get update && apt-get install -y --no-install-recommends \
    ca-certificates \
    libglib2.0-0 zlib1g libpcre2-8-0 libzstd1 libgcrypt20 \
    libmaxminddb0 libnghttp2-14 libc-ares2 \
    libcap2-bin \
    libspeexdsp1 \
    sngrep \
  && rm -rf /var/lib/apt/lists/*

COPY --from=builder /usr/local /usr/local

RUN setcap 'cap_net_raw,cap_net_admin+eip' /usr/local/bin/dumpcap || true \
 && getcap /usr/local/bin/dumpcap || true

RUN useradd -m -u 10001 tshark && mkdir -p /work && chown -R tshark:tshark /work
USER tshark
WORKDIR /work

# sin ENTRYPOINT
CMD ["/usr/local/bin/tshark", "-D"]