termshark

Overview

Termshark brings packet-capture inspection into a terminal, using tshark for analysis and drawing on Wireshark’s display filters. It suits command-line users troubleshooting traffic on a remote machine, especially when moving a large capture to a desktop is inconvenient. Its focused workflow is useful, but it cannot surface every capability available through tshark.

Key features

Termshark can open pcap files and sniff live interfaces when tshark is permitted to capture. Wireshark display filters work with saved and live traffic, and protocol-based conversation views help orient an investigation around related network activity. This is a practical toolkit for narrowing down a problem without leaving the terminal, though users who rely on tshark features that termshark does not expose will need another interface or workflow.

For flow-level inspection, it can reassemble TCP and UDP streams. Packet search reaches the packet list, structure, and bytes, and accepts strings, regular expressions, hexadecimal input, or display filters. That range is useful when a packet filter alone does not locate the relevant detail. Profiles can retain color and column preferences; termshark can also import a Wireshark column set when it can find the user's Wireshark configuration.

Remote work is a notable fit: users can analyze a capture on another machine without copying it to a desktop. The guide also includes a command for transferring the current pcap with Magic Wormhole. Termshark is implemented in Go and distributed as a single executable for each platform, but its analysis still depends on tshark being installed and in the user's PATH. Live sniffing also depends on tshark having permission to capture.

Pricing

Termshark is free and open source under the MIT License. Its sole listed plan, Termshark, costs nothing and requires tshark 1.10.2 or higher. There is no free trial because there is no paid tier to trial. The price removes a licensing cost, not the setup requirement: users must have the compatible tshark dependency available. The software is provided without warranty.

Platforms

Termshark supports Linux, macOS, BSD variants, Android through Termux, and Windows. That breadth makes it viable across a range of command-line environments, although capture permissions and the tshark dependency remain practical requirements. The project’s latest listed release is v2.4.0, released July 11, 2022.

Who it's for

Choose termshark if you already work in a terminal and need to inspect packet files or permitted live traffic, particularly on a remote machine where copying a large pcap is undesirable. Its filters, conversation views, search, and stream reassembly cover useful stages of packet investigation. Look elsewhere if your workflow depends on tshark features that termshark has not exposed, or if you cannot install and configure tshark.

Pros and cons

• Pros: Remote capture analysis avoids the need to copy a large pcap to a desktop.
• Pros: Display filters, protocol conversations, stream reassembly, and several search modes support both packet-level and flow-oriented investigation.
• Pros: Free MIT-licensed software with builds across desktop systems, BSD variants, and Android through Termux.
• Cons: tshark must be installed, meet the minimum version requirement, and be in PATH; live sniffing additionally requires capture permission.
• Cons: Some tshark features are not available through termshark, limiting it for users who need the full tshark feature set.
• Cons: The latest listed release dates to July 11, 2022, so readers seeking a more recently listed release should consider other options.

Alternatives

TShark is the direct choice when you want tshark itself rather than a terminal interface that exposes only part of its feature set. For a graphical packet-analysis workflow, Wireshark is free, while termshark is oriented around terminal use.

Scapy is another free option, with a Python 3.7+ requirement and GPLv2 license; consider it if that platform and license suit your needs. NETCAP offers a free Core plan described as an open-source CLI with 66+ audit record types and community support; its Pro plan is $548 a month. Pick it when those audit records or its stated support model matter more than termshark's capture-focused terminal interface.

NetworkMiner, PacketSnitch, Kismet, and Zui are also alternatives to compare.

Browse more options in Network Protocol Analyzers and Network Packet Analyzer Software.

Verdict

Termshark is a strong fit for command-line users who need focused packet and flow inspection on local or remote systems without paying for a license. Its remote workflow and useful search and stream tools are the case for choosing it; the required tshark setup and features it does not expose are the reasons to choose tshark or another analyzer instead.