AwesomeREA.org

Tool

termshark

Graham Clark's terminal user interface for tshark, inspired by Wireshark and aimed at inspecting captures on a remote machine, for example over SSH, without copying them back to a desktop. It reads pcap files, fifos or standard input, or captures live from one or more interfaces, and shows a packet list filtered with Wireshark display filters next to the dissected packet structure and a hex view. Analysis views reassemble TCP and UDP streams with search and client- or server-only display, list Ethernet, IPv4, IPv6, UDP and TCP conversations that can be turned into display filters, and search packet contents; Wireshark-style profiles can reuse a linked Wireshark profile's packet colors.

Targets
Protocol
Category
Protocol analysis tools
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v2.4.0, published 2022-07-11, with builds for Linux (x64, arm64, armv6), macOS (x64, arm64), FreeBSD, NetBSD, OpenBSD and Windows x64. The README also lists Arch, Debian, FreeBSD, Homebrew, MacPorts, Kali, NixOS, Snapcraft, Termux and Ubuntu packages. The reviewed master commit (2022-11-01) is 14 commits ahead of that release, including unreleased hex-view navigation changes, and master has had no commits since.
  • tshark from Wireshark, version 1.10.2 or later, must be on PATH at run time, because termshark relies on it for all packet analysis; protocol coverage is therefore whatever the installed tshark dissects. Live capture uses dumpcap and works only where the user is permitted to capture. By default, captured packets are saved in the user's cache directory (.cache/termshark/pcaps on Linux), or to a file given with -w. Copying packets to the clipboard over SSH needs X11 forwarding or a custom copy command.
  • Builds as a single Go executable with go install (module github.com/gcla/termshark/v2; go.mod declares Go 1.13). Besides theme files, the repository commits only small test captures (pkg/pcap/testdata and scripts/pcaps/telnet-cooked.pcap).
  • MIT license. The README notes that tshark has many features termshark does not expose yet. Nothing was installed, and no capture was read or taken.

About this entry

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Report an outdated entry Suggest a translation fix

Primary sources

  1. README.md GitHub · gcla/termshark · Revision e8a1ec6
  2. docs/UserGuide.md GitHub · gcla/termshark · Revision e8a1ec6
  3. docs/UserGuide.md#L87-L195 GitHub · gcla/termshark · Revision e8a1ec6
  4. docs/UserGuide.md#L313-L360 GitHub · gcla/termshark · Revision e8a1ec6
  5. docs/Packages.md GitHub · gcla/termshark · Revision e8a1ec6
  6. CHANGELOG.md GitHub · gcla/termshark · Revision e8a1ec6
  7. go.mod GitHub · gcla/termshark · Revision e8a1ec6
  8. LICENSE GitHub · gcla/termshark · Revision e8a1ec6
  9. https://github.com/gcla/termshark/releases/tag/v2.4.0

More in Protocols

All 66 entries in Protocols