termshark

Overview

Termshark is a terminal interface for tshark, drawing on Wireshark’s approach to packet inspection. It suits command-line users who need to investigate saved or live traffic, particularly on a remote machine. Its focused analysis tools are useful, but tshark remains a required dependency and some of its capabilities are outside termshark’s interface.

Key features

Termshark reads pcap files and can sniff live interfaces when tshark has permission to capture. Wireshark display filters work on saved and live traffic, and protocol-based conversation views help users narrow an investigation beyond individual packets. TCP and UDP stream reassembly adds a way to follow flows, making the tool more useful for troubleshooting than a simple packet-list viewer.

Search can target packet-list, packet-structure, and packet-byte data, using strings, regular expressions, hexadecimal input, or display filters. Profiles for colors and columns let users tailor the display; termshark can also import a Wireshark column set when it finds the relevant configuration. These are practical conveniences for repeated analysis, though they do not remove the broader limitation that termshark exposes less than tshark.

Remote analysis is a strong fit: users can inspect a capture on another machine without first copying a large pcap to a desktop. The guide also describes transferring the current pcap with Magic Wormhole. Termshark is written in Go and distributed as a single executable per platform, but packet analysis still depends on tshark being installed and available in the user's PATH.

Pricing

Termshark is free and open source under the MIT License. Its plan costs nothing and requires tshark 1.10.2 or higher. There is no paid tier or trial; users should account for the separate tshark dependency and ensure live capture is permitted where they intend to sniff interfaces. The software is provided without warranty.

Platforms

Termshark supports Linux, macOS, BSD variants, Android through Termux, and Windows. The single-executable approach across platforms makes it suited to terminal-based environments, including remote systems, while capture still depends on tshark and its permissions.

Who it's for

Choose termshark if you already work with tshark or Wireshark display filters and want a terminal-based way to inspect captures, especially when the pcap resides on a remote machine. It is less suitable when you require a tshark feature that termshark has not exposed, or cannot install and configure tshark in the required PATH.

Pros and cons

• Pro: It combines pcap reading, permitted live capture, display filters, protocol conversations, and TCP/UDP stream reassembly in a terminal interface, supporting focused investigation without a desktop workflow.
• Pro: Search spans packet summaries, structure, and bytes with several input forms, while profiles and Wireshark column import help adapt the view.
• Pro: Remote inspection avoids copying a large capture to a desktop, and the guide includes a Magic Wormhole transfer option.
• Con: tshark is mandatory and must be in PATH, adding a dependency that can complicate setup.
• Con: Some tshark features are not exposed, so users with workflows that rely on them should use another tool or tshark directly.

Alternatives

Scapy is another free option, with a Python 3.7+ requirement and GPLv2 license; consider it if that tool better fits your platform and workflow needs.

NETCAP has a free Core plan described as an open-source CLI with 66+ audit record types and community support, as well as a paid Pro plan. Consider it when those audit records are a closer fit than termshark’s interactive packet inspection.

NetworkMiner is a freemium alternative with Linux, macOS, and Windows support; consider it if you are comparing packet-analysis options across those platforms.

PacketSnitch is a freemium option for Linux, macOS, and Windows. Consider it if you want to compare another packet tool with a free tier and trial.

Arkime is free and open source, with no paid-only features or license fees; consider it if that model better suits your requirements.

Ettercap is a free open-source project for Linux, macOS, and self-hosted use; consider it if those platforms and its source-code availability match your needs.

Kismet is free and open source, with no paid plan or usage limit stated; consider it if you want to compare another free option.

OpenGrep is a free open-source static analysis CLI; consider it for static analysis rather than packet inspection.

Browse more options in Network Protocol Analyzers and Network Packet Analyzer Software.

Verdict

Termshark is a strong free choice for command-line users who need to analyze captures where they are stored, particularly on remote machines. Its search, filters, conversation views, and stream reassembly cover substantial inspection work, but the required tshark dependency and its unexposed features make it the wrong choice when you need the full tshark feature set or cannot meet that dependency.