Termshark

Termshark is a terminal interface for tshark, intended for examining saved packet captures and live network traffic. It reads pcap files and can sniff live interfaces when tshark permits, then apply Wireshark display filters to either. Users can reassemble and inspect TCP and UDP flows, search packets, copy packet ranges, and view conversations involving Ethernet, IPv4, IPv6, UDP, and TCP. The project describes a remote debugging use case: inspecting a large capture on its machine rather than copying it to a desktop. It supports Linux, macOS, BSD variants, Android through Termux, and Windows, with precompiled executables available through GitHub releases. The program is free, but packet analysis requires tshark version 1.10.2 or newer to be available in the PATH. The project also notes that tshark includes capabilities Termshark does not currently expose. Its user guide estimates loaded packet data at approximately 10 MB of RAM for every 1,000 packets.

Termshark provides packet inspection and filtering from a terminal, including for remote capture files and live traffic. Check the tshark dependency and the project's noted feature gap before relying on it for a particular workflow.

Termshark suits people debugging on remote machines who want to inspect captures without moving them to a desktop. It also fits terminal users who need display filters and TCP or UDP flow inspection.

Termshark is a free terminal interface for analyzing packet captures through tshark. It suits people debugging on remote machines or reviewing pcaps without moving them to a desktop. Its main trade-off is that it depends on tshark and does not expose all of tshark’s features.

Overview

Termshark brings interactive packet inspection to the machine where the traffic or capture file lives. It can read pcap files and sniff live interfaces when tshark has permission, making it useful for remote troubleshooting as well as offline trace review. The terminal approach avoids requiring a desktop interface, but it is only a good fit if the command-line environment works for the task.

This is a user interface for tshark, not a substitute for its full capabilities. Packet analysis requires tshark 1.10.2 or newer in the PATH, and some tshark features are not exposed. That makes Termshark a practical choice for common inspection workflows, but a poor fit when a specific analysis depends on functionality available only in tshark.

Key features

• Capture and pcap review: Open pcap files or capture from live interfaces, subject to tshark permissions. Remote pcap analysis is particularly useful when copying a large file to a desktop is inconvenient.
• Display filters: Apply Wireshark display filters to saved captures and live traffic, narrowing the view without leaving the terminal.
• Flow and conversation analysis: Reassemble and inspect TCP and UDP flows. The conversation view covers Ethernet, IPv4, IPv6, UDP, and TCP, so its protocol scope is clear rather than universal.
• Search and packet copying: Search packets and copy packet ranges to the clipboard from the terminal, helping users isolate and carry forward relevant portions of a capture.
• Display customization: Profiles store color and column settings. Support for 16-color, 256-color, and truecolor terminal modes gives users options suited to their terminal.
• Resource use: Loaded packet data uses approximately 10 MB of RAM per 1,000 packets, a consideration when working with large captures on memory-constrained machines.

Pricing

Termshark is free: the Termshark plan costs nothing. It includes packet analysis without a license fee, but requires tshark in the PATH, with version 1.10.2 or newer, and does not expose every tshark feature. There is no paid tier to unlock a broader Termshark feature set.

The project identifies the software as MIT licensed. Precompiled executables are available through GitHub releases, and GitHub is the place for setup guidance, bug reports, and feature requests.

Platforms

Termshark supports Linux, macOS, BSD variants, Windows, and Android through Termux. The range is useful for users who want a terminal workflow across different systems, though platform support does not remove the need to install and provide tshark in the PATH.

Who it's for

Termshark is best for network troubleshooters and developers who need to inspect traffic on a remote host or work with pcap files without transferring them to a desktop. It also suits users who prefer terminal-based tools and need display filters, flow inspection, and packet search. Choose another tool if your workflow requires the full feature set tshark offers or a conversation protocol outside Termshark’s stated coverage.

Pros and cons

Pros

• Can inspect large remote pcap files where they reside, avoiding a file transfer to a desktop.
• Handles both offline pcap review and live capture, with Wireshark display filters for each.
• Provides TCP and UDP flow inspection, packet search, packet-range copying, and configurable color and column profiles at no cost.
• Runs on Linux, macOS, BSD variants, Windows, and Android through Termux.

Cons

• Requires tshark 1.10.2 or newer in the PATH, adding a dependency users must install and maintain.
• Exposes fewer features than tshark, which can rule it out for specialized analysis needs.
• Live capture depends on tshark being permitted to access the interface.
• Loaded packet data uses approximately 10 MB per 1,000 packets, which can matter when opening large traces on constrained systems.

Alternatives

Browse network packet capture software for other options in this category.

• Wireshark is a free option for Linux, macOS, and Windows; choose it when a desktop packet-analysis interface is preferable to Termshark’s terminal workflow.
• TShark is a free option for Linux, macOS, and Windows; choose it when you want to work directly with tshark rather than through Termshark’s interface.
• Malcolm is free, self-hosted software for Linux, macOS, and Windows as well as API and web use; choose it when a self-hosted, web-accessible approach is a better fit.
• PCAPdroid offers a free Android plan for core network monitoring and capture, with paid features excluded; choose it when Android is the priority.
• Arkime is free, open-source software for self-hosted, web, API, and Linux use; choose it when that deployment model suits your workflow.
• tcpdump is free software for Linux, macOS, and Windows; choose it when a BSD-licensed packet capture tool is preferable, keeping in mind that capture permission depends on operating system and configuration.
• EndaceProbe uses on-premises appliances and cloud deployments, with model capacities from 500 Mbps to 100 Gbps sustained recording; choose it when those deployment options and recording capacities fit the need.
• Sniffnet is fully free and open-source for Linux, macOS, and Windows; consider it as another no-cost option on those platforms.

Verdict

Choose Termshark if you need free, terminal-based pcap inspection on the machine where the traffic was captured, especially for remote debugging. Its combination of display filtering and flow inspection is useful without moving captures to a desktop. Look elsewhere if you need tshark’s complete feature set or cannot accommodate its required dependency.