A terminal user-interface for tshark, inspired by Wireshark.
V2.4 is out now with packet search and profiles for colors and columns! See the ChangeLog.
If you're debugging on a remote machine with a large pcap and no desire to scp it back to your desktop, termshark can help!
- Read pcap files or sniff live interfaces (where tshark is permitted)
- Filter pcaps or live captures using Wireshark's display filters
- Reassemble and inspect TCP and UDP flows
- View network conversations by protocol
- Copy ranges of packets to the clipboard from the terminal
- Written in Golang, compiles to a single executable on each platform - downloads available for Linux, macOS, BSD variants, Android (termux) and Windows
tshark has many more features that termshark doesn't expose yet! See What's Next.
Termshark is pre-packaged for the following platforms: Arch Linux, Debian (unstable), FreeBSD, Homebrew, MacPorts, Kali Linux, NixOS, SnapCraft, Termux (Android) and Ubuntu.
Termshark uses Go modules. Set GO111MODULE=on
then run:
go install github.com/gcla/termshark/v2/cmd/[email protected]
For versions of Go between 1.14 and 1.17, use
go get github.com/gcla/termshark/v2/cmd/termshark
Then add ~/go/bin/
to your PATH
.
For all packet analysis, termshark depends on tshark from the Wireshark project. Make sure tshark
is in your PATH
.
Inspect a local pcap:
termshark -r test.pcap
Capture ping packets on interface eth0
:
termshark -i eth0 icmp
Run termshark -h
for options.
Pre-compiled executables are available via Github releases. Or download the latest build from the master branch - .
See the termshark user guide, and my best guess at some FAQs. For a summary of updates, see the ChangeLog.
Termshark depends on these open-source packages:
- tshark - command-line network protocol analyzer, part of Wireshark
- tcell - a cell based terminal handling package, inspired by termbox
- gowid - compositional terminal UI widgets, inspired by urwid, built on tcell
Note that tshark is a run-time dependency, and must be in your PATH
for termshark to function. Version 1.10.2 or higher is required (approx 2013).
Thanks to everyone that's contributed ports, patches and effort!
- The author - Graham Clark ([email protected])
fork by