termshark

termshark is a terminal interface for tshark that lets users inspect packet captures and live network traffic. It can read pcap files or sniff live interfaces when tshark is permitted, making it suitable for examining a capture on a remote machine without moving it to a desktop. Users can apply Wireshark display filters, view conversations grouped by protocol, and reassemble TCP and UDP streams. Search covers packet lists, structures, and bytes, using text, regular expressions, hexadecimal input, or display filters. The guide also describes importing a Wireshark column set when the relevant configuration can be found, and transferring the current capture with Magic Wormhole. The project is free and MIT-licensed, with builds for Linux, macOS, BSD variants, Android through Termux, and Windows. Packet analysis depends on tshark 1.10.2 or higher being available in the user's PATH. Some tshark features are not exposed in termshark. The latest listed release is v2.4.0, dated July 11, 2022.

termshark offers terminal-based packet inspection, filtering, search, and flow analysis across several platforms. Its capabilities depend on tshark, and the project notes that not all tshark features are available through the interface.

It suits network troubleshooters who want to inspect captures in a terminal, including on remote machines. Users need tshark installed and available in their PATH.

Overview

Termshark is a shell-based interface for inspecting network packets through tshark. It suits command-line users who need to investigate traffic on a remote machine or work directly with capture files. Its free, focused toolkit is useful for packet analysis, but tshark remains a required dependency and some of its capabilities are outside the interface.

Key features

Termshark can open pcap files and inspect live interfaces when tshark has permission to capture. Wireshark display filters work across saved and live traffic, and protocol-based conversation views help group related activity. Together, these tools support focused troubleshooting without requiring a graphical analyzer, although the interface does not cover every tshark feature.

For flow-level investigation, termshark can reassemble TCP and UDP streams. Packet search reaches packet-list, packet-structure, and packet-byte data, with support for strings, regular expressions, hexadecimal input, and display filters. The v2.4.0 release added search and profiles for colors and columns; users can also import a Wireshark column set when the application can find the Wireshark configuration.

Remote work is a strong fit: users can inspect a capture on another machine without copying a large pcap to a desktop. The guide also includes a way to transfer the current capture using Magic Wormhole. Termshark is built as a single executable for each platform, but packet analysis still depends on tshark being installed and present in the user's PATH.

Pricing

Termshark is free and open source under the MIT License. Its plan costs nothing and requires tshark 1.10.2 or higher; there is no free trial because the software is already free. This makes it a sensible option for individuals or teams seeking a no-cost terminal interface, with no paid tier or seat limit to weigh. The trade-off is that the software comes without warranty, and setup depends on a separate tshark installation.

Platforms

Project downloads cover Linux, macOS, BSD variants, Android through Termux, and Windows. The directory also identifies Android, Linux, macOS, and Windows as supported. The single-executable design keeps deployment straightforward across supported systems, while live sniffing remains subject to tshark capture permissions.

Who it's for

Termshark is best for network administrators, developers, and troubleshooting teams comfortable in a terminal, especially those working on remote machines where transferring a large capture is inconvenient. Its display filters, packet search, conversation views, and stream reassembly provide several routes from broad capture review to specific flows. It is a weaker choice for users who need every tshark feature exposed in an interface or who cannot install and configure tshark.

Pros and cons

• Pro: Reads pcap files and can sniff live traffic, so one interface supports both saved-capture review and permitted live investigation.
• Pro: Search spans packet lists, structures, and bytes, with multiple input styles that help locate details beyond a simple filter.
• Pro: Remote capture analysis avoids copying large files back to a desktop.
• Con: Requires tshark in the user's PATH, adding a dependency that must be installed and configured.
• Con: Some tshark features are not exposed, limiting its suitability for workflows that rely on the full toolkit.
• Con: Live sniffing depends on capture permissions, so it is not available in every environment.

Alternatives

For browser-based public capture review, A-Packets offers a free public-analysis plan with no signup and a 25 MB upload cap; results are public and captures are sanitized. That is a better fit when a web workflow matters more than private, local terminal inspection.

NetworkMiner is a free, open-source alternative for readers seeking a graphical network forensics tool, with Linux, macOS, and Windows platforms listed. PacketSnitch is another option for users considering a paid product that also has a free plan and trial, with Linux, macOS, and Windows support.

RedSplice Network Analyzer may suit users who need to decode non-local captured data or want unlimited capture time through its Professional plan; its Free plan is limited to local traffic and capture time. For a Python-based packet manipulation toolkit, consider Scapy, which is free and runs across several listed environments.

Arkime is a free, open-source option for readers looking for a web-oriented platform without license fees. Colasoft Capsa may fit Windows users who prefer a graphical analyzer, though its free edition caps monitoring at 10 IP addresses, limits sessions to four hours, and excludes WiFi monitoring. EtherApe is a free alternative for Linux users.

Browse more options in Network Protocol Analyzers and Network Packet Analyzer Software.

Verdict

Choose termshark if you want a free terminal interface for targeted packet and flow analysis, particularly on remote machines where large captures are cumbersome to move. Its strongest case is combining familiar Wireshark filters and useful search with a terminal workflow. Look elsewhere if you need tshark's full feature set, cannot meet the dependency or capture-permission requirements, or prefer a graphical or web-based analyzer.