Skip to content
Get packs

Guide · Open source

How to use termshark: install, open pcap files and filter traffic

Updated · written with AI from the project's own documentation and checked against our catalogue data

Termshark is a text-based interface for tshark, the command-line packet analyzer from the Wireshark project. It lets you open packet capture (pcap) files or watch live network interfaces without a graphical desktop, which makes it useful on remote servers. This guide covers installing it, opening a capture, capturing live traffic and filtering packets, so you can start inspecting traffic from a terminal.

termsharkgcla/termshark · ★ 10.1k · MIT

Quick start

  1. 1Install tshark. Install tshark from the Wireshark project and confirm it is in your PATH.
  2. 2Install termshark. Run the Go module install command from the README with GO111MODULE=on.
  3. 3Add the Go bin directory to PATH. Add ~/go/bin/ to your PATH so the termshark binary can be run.
  4. 4Open a capture. Run termshark -r on a pcap file to browse it in the terminal.
  5. 5Capture live traffic. Run termshark -i with an interface name, such as eth0, and optionally add a display filter.
  6. 6Read the options. Run termshark -h to see all available options and the user guide for key bindings.

What you need before installing termshark

Termshark depends on tshark from the Wireshark project at run time. tshark must be installed and available in your PATH, or termshark will not function.

Termshark is written in Go and the README says to install it with Go modules. The source excerpt does not state a specific Go version, though it notes that Go versions between 1.14 and 1.17 use a different command.

  • tshark from the Wireshark project, in your PATH
  • Go, with the Go modules approach described in the README

Install termshark with Go

Set GO111MODULE=on, then run the install command from the README. This places the termshark binary in your Go bin directory.

For Go versions between 1.14 and 1.17, the README uses go get instead. After installing, add ~/go/bin/ to your PATH. Pre-built executables are also available from the GitHub releases page, and the README lists several platform packages such as Homebrew, Arch Linux, Debian (unstable), FreeBSD, NixOS and Ubuntu.

GO111MODULE=on go install github.com/gcla/termshark/v2/cmd/termshark@v2.4.0

Open a pcap file with termshark

The simplest use is to inspect a capture file you already have. Pass the file to termshark with the -r option. This is the workflow the README describes for debugging on a remote machine with a large pcap, where you would rather not copy the file back to your desktop.

Run termshark -h to see the available options.

termshark -r test.pcap

Capture live traffic from a network interface

To sniff a live interface, give termshark the interface name with -i. The README example captures ICMP (ping) packets on eth0. Live capture only works where tshark is permitted to capture.

The trailing argument is a display filter in Wireshark syntax. Termshark supports Wireshark's display filters for both pcap files and live captures.

  • Use -i to choose the interface, such as eth0 in the example
  • Add a display filter after the interface to limit what is shown
termshark -i eth0 icmp

Filter, follow and inspect traffic

Termshark lets you filter pcaps or live captures using Wireshark's display filters. It can also reassemble and inspect TCP and UDP flows, and show network conversations by protocol.

You can copy ranges of packets to the clipboard from inside the terminal. The v2.4 release notes in the README mention packet search and profiles for colors and columns. For full key bindings and workflows, read the user guide linked from the README (docs/UserGuide.md).

  • Filter with Wireshark display filters
  • Reassemble and inspect TCP and UDP flows
  • View conversations by protocol
  • Copy packet ranges to the clipboard

Know the limits of termshark

Termshark does not expose all of tshark's features. The README says tshark has many more features that termshark does not yet expose, and points to the What's Next section of the FAQ.

If you need the full Wireshark feature set or its graphical interface, use Wireshark itself. The README also lists the FAQ and user guide as the places to check for answers beyond this overview.

What people use it for

  • Debugging a remote server over SSH by inspecting a large pcap in place
  • Watching ICMP or other protocol traffic on a live interface from a terminal
  • Reassembling TCP or UDP flows to see the content of a conversation
  • Checking which protocols make up traffic between hosts by viewing conversations

Frequently asked questions

Is termshark free?

Termshark is released under the MIT licence, as stated in the project's listing. The MIT licence permits use, including commercial use, under its terms.

Does termshark require Wireshark to be installed?

Termshark needs tshark, the command-line tool from the Wireshark project, to be installed and in your PATH. The README states that tshark is a run-time dependency.

How do I install termshark?

The README gives a Go module install command: GO111MODULE=on go install github.com/gcla/termshark/v2/cmd/termshark@v2.4.0. You can also use pre-compiled executables from GitHub releases or a platform package manager.

What is termshark used for?

It is used to browse and filter pcap files or live captures in a terminal. People most often use it when debugging on a remote machine and they want to avoid copying a large capture to their desktop.

Can termshark do everything Wireshark does?

No. The README says termshark only exposes part of tshark's features. If you need Wireshark's graphical interface and full feature set, use Wireshark.

What are alternatives to termshark?

The project lists Wireshark, tcpdump, Zeek and ngrep as comparable projects. Wireshark offers a graphical interface, while tcpdump and ngrep are also command-line tools.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

Termshark suits engineers who already know Wireshark and need to inspect packet captures over SSH or on a remote server without copying files. It is a poor first tool for beginners without networking background, and anyone who needs Wireshark's full feature set or graphical interface should use Wireshark instead.

Install options & downloads