A terminal UI for tshark, providing Wireshark-like packet analysis directly in the terminal.
Termshark is a terminal user interface (TUI) for tshark, the command-line packet analyzer. It provides an interactive, Wireshark-inspired interface within the terminal for inspecting packet capture (pcap) files and live network traffic. It solves the problem of analyzing network packets on remote servers or headless environments where a full graphical Wireshark installation is not feasible.
Network engineers, system administrators, security analysts, and developers who need to perform packet analysis in terminal-only or remote environments, or who prefer command-line workflows.
Developers choose Termshark because it delivers the core analytical power of Wireshark/tshark in a lightweight, terminal-native interface. Its single-binary portability and ability to handle large pcaps remotely offer a significant advantage over transferring files for desktop GUI analysis.
A terminal UI for tshark, inspired by Wireshark
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Compiled in Go to a single executable for multiple platforms including Linux, macOS, Windows, and Android, as highlighted in the README, making it easy to deploy without complex dependencies.
Supports Wireshark's powerful display filter syntax for packet filtering, allowing users to leverage familiar, industry-standard queries directly in the terminal.
Enables copying packet ranges to clipboard and operating entirely within the terminal, ideal for remote SSH sessions or headless environments where GUI access is impractical.
Can inspect pcap files or sniff live network interfaces using tshark, providing flexibility for both historical and real-time packet debugging, as demonstrated in the quick start examples.
Requires tshark to be installed and in PATH, adding an external dependency that may not be available in all environments, and limiting standalone use.
The README explicitly states that 'tshark has many more features that termshark doesn't expose yet,' meaning advanced protocol analysis tools are missing compared to full Wireshark.
Terminal interfaces may struggle with very large packet captures or high-speed live traffic due to refresh rate constraints, unlike optimized GUI applications.
termshark is an open-source alternative to the following products: