A terminal user-interface for tshark, inspired by Wireshark.
V2.4 is out now with packet search and profiles for colors and columns! See the ChangeLog.
If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help!
tshark has many more features that termshark doesn't expose yet! See What's Next.
Termshark is pre-packaged for the following platforms: Arch Linux, Debian (unstable), FreeBSD, Homebrew, MacPorts, Kali Linux, NixOS, SnapCraft, Termux (Android) and Ubuntu.
Termshark uses Go modules. Set GO111MODULE=on
then run:
go install github.com/gcla/termshark/v2/cmd/[email protected]
For versions of Go between 1.14 and 1.17, use
go get github.com/gcla/termshark/v2/cmd/termshark
Then add ~/go/bin/
to your PATH
.
For all packet analysis, termshark depends on tshark from the Wireshark project. Make sure tshark
is in your PATH
.
Inspect a local pcap:
termshark -r test.pcap
Capture ping packets on interface eth0
:
termshark -i eth0 icmp
Run termshark -h
for options.
Pre-compiled executables are available via Github releases. Or download the latest build from the master branch - .
See the termshark user guide, and my best guess at some FAQs. For a summary of updates, see the ChangeLog.
Termshark depends on these open-source packages:
Note that tshark is a run-time dependency, and must be in your PATH
for termshark to function. Version 1.10.2 or higher is required (approx 2013).
Thanks to everyone that's contributed ports, patches and effort!