Alternatives to Termshark
Terminal interface for tshark that feels like Wireshark. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
Termshark
Terminal interface for tshark that feels like Wireshark.
Replacements
Listings that take over the same core job as Termshark.
Wireshark
The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols.
Wireshark is the full graphical analyser that Termshark imitates, with the same dissectors, and it adds Windows builds, but it needs a desktop rather than an SSH terminal.
tcpdump
The classic command-line packet capture and analysis tool.
tcpdump is a command-line capture tool available on nearly every Unix system and Windows, writing standard pcap files, but its output is dense text with no interactive packet browser.
NetworkMiner
Network forensics tool that extracts files and credentials from captures.
NetworkMiner gives a host-centric view that reconstructs files and credentials from captures, runs on Windows and Linux as a desktop app, and reserves some features for its paid Professional edition.
ngrep
A command-line packet capture tool that matches network payloads against regular or hexadecimal expressions.
ngrep matches packet payloads against expressions in a terminal, but gives text output with no protocol decoding like termshark's tshark dissection.
Similar software
Related functionality, not a direct replacement.
Sniffnet
Shows what your machine is actually talking to, with charts instead of a wall of packets.
Arkime
Store and search captured network traffic through a web interface.
RustNet
Terminal network monitor showing live connections per process with packet inspection.
Npcap
Windows packet capture driver used by Wireshark, Nmap and similar tools.
TCPView
Sysinternals viewer for active TCP and UDP endpoints on Windows.
