Termshark
Terminal interface for tshark that feels like Wireshark.
These buttons open the developer's own site, repository or store listing in a new tab. wares.gg does not host downloads.
1 more ways to get Termshark
Package managers
- Homebrew
brew install termshark
About Termshark
Termshark presents packet captures in a terminal with the packet list, detail tree and hex view of Wireshark, reading live interfaces or pcap files through tshark. It is designed for analysing captures over SSH where no graphical display exists.
Strengths
- Wireshark-style analysis over an SSH session with no X forwarding
- Uses tshark, so dissection matches Wireshark exactly
Limitations
- Requires tshark installed
- Fewer features than the Wireshark graphical application
Details
- Pricing
- FreeFree and open source under the MIT licence.
- License
- MIT
- Developer
- Graham Clark
- Platforms
- macOS, Linux, Command line
- How it runs
- Downloadable app
- Best suited for
- Terminal interface for tshark that feels like Wireshark
- Categories
- Network tools
- Last verified
- Added
- Provenance
- Selected from the TechWalrus Resource Hub (Networking & Diagnostics); facts checked against the developer's own pages, 3 sources on file.
Alternatives to Termshark
Compare allSoftware that can replace Termshark for an important use case, and what changes if you switch.
Wireshark
The network protocol analyser: capture traffic and read it packet by packet, with dissectors for hundreds of protocols.
Wireshark is the full graphical analyser that Termshark imitates, with the same dissectors, and it adds Windows builds, but it needs a desktop rather than an SSH terminal.
tcpdump
The classic command-line packet capture and analysis tool.
tcpdump is a command-line capture tool available on nearly every Unix system and Windows, writing standard pcap files, but its output is dense text with no interactive packet browser.
NetworkMiner
Network forensics tool that extracts files and credentials from captures.
NetworkMiner gives a host-centric view that reconstructs files and credentials from captures, runs on Windows and Linux as a desktop app, and reserves some features for its paid Professional edition.
ngrep
A command-line packet capture tool that matches network payloads against regular or hexadecimal expressions.
ngrep matches packet payloads against expressions in a terminal, but gives text output with no protocol decoding like termshark's tshark dissection.
Similar software
Related functionality, not necessarily a direct replacement.
Sniffnet
Shows what your machine is actually talking to, with charts instead of a wall of packets.
Arkime
Store and search captured network traffic through a web interface.
RustNet
Terminal network monitor showing live connections per process with packet inspection.
Npcap
Windows packet capture driver used by Wireshark, Nmap and similar tools.
TCPView
Sysinternals viewer for active TCP and UDP endpoints on Windows.
