termshark
A terminal interface for tshark, the command-line version of Wireshark, for reading and filtering packet captu
- Stars
- 10.1k
- Forks
- 443
- Licence
- MIT
- Language
- Go
- Last update
- 2.5 years ago
- Type
- CLI
No commits in over a year — check for forks or alternatives before adopting.
What it is
Termshark is a text-based user interface that wraps tshark, the command-line packet analyzer from the Wireshark project. It lets you open packet capture (pcap) files or watch live network interfaces and browse, filter, and inspect traffic without a graphical desktop. People use it most often when debugging on a remote machine where copying a large capture to a local computer is inconvenient.
- Open a local pcap file with termshark -r and browse its packets
- Capture ICMP packets on a network interface such as eth0
- Apply Wireshark display filters to narrow down a capture
- Reassemble and inspect TCP and UDP flows
- View network conversations grouped by protocol
Great for
- Engineers debugging network problems over SSH on remote servers
- People who know Wireshark and want a similar workflow in a terminal
- Anyone who needs to inspect a large pcap file without copying it off the machine
Not ideal for
- Users who need Wireshark's graphical interface and its full feature set, since termshark only exposes part of tshark's features
- Beginners with no networking background, since the tool assumes familiarity with packet captures and display filters
How to get it
- 1
Install with a package manager
You'll need: Go (the README says to use Go modules; a specific Go version is not stated in the excerpt) · tshark from the Wireshark project, available in your PATH
Install termshark with Go modules
go install github.com/gcla/termshark/v2/cmd/termshark@v2.4.0 - 2
Run it
- Install tshark from Wireshark and make sure it is in your PATH
- Install termshark with the go install command above
- Add ~/go/bin/ to your PATH if needed
- Run termshark -r test.pcap to inspect a local capture
- 3
Get the most out of it
- Run termshark -h to see all command-line options
- Use Wireshark display filters to narrow the packets you see
- Use the packet search and profiles for colors and columns introduced in v2.4, as described in the README
- Copy ranges of packets to the clipboard from the terminal
- Read the user guide at docs/UserGuide.md for configuration details
Downloads
Strengths
- Compiles to a single executable and has downloads for Linux, macOS, BSD variants, Android (termux), and Windows
- Uses Wireshark's display filter syntax and the tshark engine for packet analysis
- Open source under the MIT license with a long history and over 10,000 stars
Trade-offs
- Requires tshark to be installed separately and on your PATH, and it depends on tshark for all analysis
- Exposes only part of tshark's functionality, as the README itself notes
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| termshark (this) | 10.1k | CLI | intermediate | 2.5 years ago | Engineers debugging network problems over SSH on remote servers |
| gh-dash | 12.7k | CLI | intermediate | 10 days ago | Developers who spend most of their day in the terminal |
| bubbletea | 45.6k | Library | intermediate | 4 days ago | Go developers who want to build interactive command-line tools with a visual interface |
| superfile | 24k | App | beginner | 7 days ago | People who spend a lot of time in the terminal and want a visual file browser there |
| lipgloss | 12k | Library | intermediate | 4 days ago | Go developers building terminal user interfaces |
| rclone | 60.7k | CLI | intermediate | 5 days ago | People comfortable using a terminal who need to move files between cloud providers |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.