What is the difference between tshark, dumpcap and others for collecting/sniffing traffic?

Question

Wireshark provides tshark and dumpcap, and I've also seen people using the wireshark binary or even tcpdump to collect/save network traffic.

Online it is claimed that tshark or dumpcap hardly make a difference though. There are also some other discussion about the memory footprint.

So what is the difference between these tools? Is one newer than another one (i.e. is one "legacy" and should not be used anymore) and are there other – generally accepted – recommendations for which to use?

Edit: I've seen this question, but it just explains the basics. So if you have a use-case of just collect traffic, what should one use here? Or more general: Which tool can satisfy which use case?

Answer 1

Wireshark is a graphical application. tshark is that application without the GUI. (i.e. command line.) dumpcap, per Wireshark's documentation, is "a small program whose only purpose is to capture network traffic, while retaining advanced features like capturing to multiple files (since version 0.99.0). Dumpcap is the engine under the Wireshark/tshark hood." All three applications can write to a file. Wireshark's GUI can select which packets one wants to save. (tshark will record everything.)

tcpdump is a different, older, traffic capture application. It never had a GUI. And has a very different filter syntax, and capture packet format.

(Personal preference... I use tcpdump at the command line and for capture files. Then use Wireshark to look at the traffic in detail.)