GUI required? Use on headless Ubuntu Server via SSH?

edit

(If I shouldn't turn this into a "newbie's questions" thread beyond the scope of my original question, please let me know.)

What's the most expedient way to access/read the pcapng files that tshark writes?

Got it -- tcpdump

tcpdump is also useful but doesn't have some of the filtering capabilities that tshark has. Use whatever's appropriate for you.

To examine the captures, transfer them to another host that can run Wireshark.

I meant tcpdump only for examining the tshark pcapng file output, after Ctrl-C-ing out of tshark.

tcpdump dissects much less traffic than tshark, but if it meets your needs it's good enough. Arguably you could also use tcpdump to make the captures.