termshark
A terminal UI for tshark, providing Wireshark-like packet analysis directly in the terminal.
What is termshark?
Termshark is a terminal user interface (TUI) for tshark, the command-line packet analyzer. It provides an interactive, Wireshark-inspired interface within the terminal for inspecting packet capture (pcap) files and live network traffic. It solves the problem of analyzing network packets on remote servers or headless environments where a full graphical Wireshark installation is not feasible.
Network engineers, system administrators, security analysts, and developers who need to perform packet analysis in terminal-only or remote environments, or who prefer command-line workflows.
Developers choose Termshark because it delivers the core analytical power of Wireshark/tshark in a lightweight, terminal-native interface. Its single-binary portability and ability to handle large pcaps remotely offer a significant advantage over transferring files for desktop GUI analysis.
Overview
A terminal UI for tshark, inspired by Wireshark
Use Cases
Best For
- Analyzing packet captures on remote servers over SSH
- Debugging network issues in headless or minimal Linux environments
- Performing quick packet inspection without a desktop GUI
- Learning network protocols using a terminal-based tool
- Integrating packet analysis into command-line scripting workflows
- Security monitoring and incident response on terminal-accessible systems
Not Ideal For
- Projects requiring Wireshark's full graphical analysis tools like IO graphs or geolocation maps
- High-speed network monitoring where real-time GUI responsiveness is critical
- Teams needing advanced collaborative features or integrated reporting found in desktop Wireshark
- Environments where tshark cannot be installed due to administrative restrictions
Pros & Cons
Pros
Compiled in Go to a single executable for multiple platforms including Linux, macOS, Windows, and Android, as highlighted in the README, making it easy to deploy without complex dependencies.
Supports Wireshark's powerful display filter syntax for packet filtering, allowing users to leverage familiar, industry-standard queries directly in the terminal.
Enables copying packet ranges to clipboard and operating entirely within the terminal, ideal for remote SSH sessions or headless environments where GUI access is impractical.
Can inspect pcap files or sniff live network interfaces using tshark, providing flexibility for both historical and real-time packet debugging, as demonstrated in the quick start examples.
Cons
Requires tshark to be installed and in PATH, adding an external dependency that may not be available in all environments, and limiting standalone use.
The README explicitly states that 'tshark has many more features that termshark doesn't expose yet,' meaning advanced protocol analysis tools are missing compared to full Wireshark.
Terminal interfaces may struggle with very large packet captures or high-speed live traffic due to refresh rate constraints, unlike optimized GUI applications.
Open Source Alternative To
termshark is an open-source alternative to the following products:
Frequently Asked Questions
Related Projects
iperfiperf3: A TCP, UDP, and SCTP network bandwidth measurement tool
openwifiopen-source IEEE 802.11 WiFi baseband FPGA (chip) design: driver, software
nethogsLinux 'net top' tool
pysharkPython wrapper for tshark, allowing python packet parsing using wireshark dissectors
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.