Termshark — Network Analysis and Diagnostics

Latest Tool Guides / Network Analysis and Diagnostics / termshark.html

A terminal UI for tshark (Wireshark CLI). Analyze packets like Wireshark in server environments.

Basic Information

What is this program?

Termshark is a tool that wraps tshark, the command-line version of Wireshark, into a Terminal User Interface (TUI). It allows you to browse, filter, and analyze packets with a mouse and keyboard even on servers accessed via SSH, enabling you to work like Wireshark in environments without a GUI.

It opens pcap and pcapng files and displays the packet list, protocol layer tree, and raw (hex) data in three panes. It also supports live capture and uses the tshark engine directly if tshark is installed.

What problem does it solve?

• Used when you need to visually analyze pcap files on servers without a GUI.
• Used when you need Wireshark-level packet analysis in an SSH environment.
• Used for immediate investigation of network issues while logged into the server.
• Used for remote analysis of pcap files captured on the server without transferring them directly to team members.

Key Features

3-Pane Packet View

Displays the packet list, protocol layers, and raw data in three areas simultaneously.

• Usage Scenario: Select a packet to view the detailed structure of its data in real-time.
• Result Obtained: Use the same 3-pane structure as Wireshark in the terminal.
• Limitations: If terminal resolution is low, the three areas may appear narrow.

Replay Filter

Supports Wireshark's display filter syntax exactly.

• Usage Scenario: Enter filters like ip.addr == 10.0.0.5 && tcp.port == 443.
• Result Obtained: Wireshark users can adapt directly.
• Limitations: If the filter syntax is incorrect, the results may appear empty.

Live Capture

Captures from network interfaces in real-time and analyzes them via the TUI.

• Usage Scenario: Used when capturing and analyzing traffic directly on the server.
• Result Obtained: Perform capture and analysis in a single screen.
• Limitations: Requires capture permissions (root or cap_net_raw).

SSH Remote Analysis

Opens and analyzes pcap files from an SSH session, eliminating the need for file transfers.

• Usage Scenario: Used when analyzing a remote server's pcap files without downloading them locally.
• Result Obtained: Start analysis immediately without transfer.
• Limitations: Large pcap files may slow down SSH response.

Installation & Execution

Binary Download

Install from GitHub releases. It is recommended to install tshark as well.

# Install tshark (Wireshark CLI engine)
sudo apt install -y tshark

# Download termshark binary
wget https://github.com/gcla/termshark/releases/latest/download/termshark_2.4.0_linux_x86_64.tar.gz
tar xzf termshark_*.tar.gz
sudo mv termshark /usr/local/bin/

# Verify installation
termshark --version

go install

Install in a Go environment.

go install github.com/gcla/termshark/cmd/termshark@latest

macOS / Homebrew

Install using Homebrew.

brew install termshark

Usage Examples

Open a pcap file

Analyze a saved pcap file with the TUI.

# Open a pcap file
termshark -r capture.pcapng

# In the TUI, select a packet → View protocol tree and raw data

Live Capture & Filter

Capture from an interface while applying a filter.

# Live capture on eth0
sudo termshark -i eth0

# Enter filter in the TUI:
# tcp.port == 443
# http.request.method == "POST"

Analyze Remote Server pcap via SSH

Analyze a pcap file while logged into the server.

# After SSH connection, run termshark
ssh user@server
termshark -r /var/log/capture.pcap

# Analyze directly on the remote server, no file transfer needed