DOCSEARCHbyAlgolia
Submit Docs

termshark

repository·master·Indexed 27 days ago

https://github.com/gcla/termshark

A terminal-based user interface (TUI) for tshark that provides a Wireshark-like experience for network protocol analysis. It allows users to read pcap files, sniff live interfaces, and apply Wireshark display filters directly in the terminal. Termshark supports Linux, macOS, BSD, Android/Termux, and Windows, and requires tshark version 1.10.2 or newer as a runtime dependency.

Tokens
7.9K
Snippets
23
Records
73
Agent score
88%

What's inside termshark

  1. Overview of Termshark

    master

    Termshark is a terminal user-interface (TUI) for tshark, inspired by Wireshark. It allows you to debug network traffic on remote machines with large pcap files without needing to transfer them locally.

    Key features include:

    • Reading pcap files or sniffing live interfaces (requires tshark).
    • Filtering captures using Wireshark's display filters.
    • Reassembling and inspecting TCP and UDP flows.
    • Viewing network conversations by protocol.
    • Copying packet ranges to the clipboard from the terminal.
    • Single executable deployment (supports Linux, macOS, BSD, Android/Termux, and Windows).

  2. Read a pcap file

    master
    To inspect an existing packet capture file, use the -r flag. If you provide a filter as an argument, it is interpreted as a display filter (following tshark behavior). Once the UI is open, you can press ? to access the help menu. Termshark also tracks recently loaded files, which can be accessed via a "Recent" button in the UI.

  3. Install Termshark on Termux (Android)

    master

    To use Termshark on Android via Termux, you must install the root-repo to access tshark.

    If you want to use Termshark's copy-mode to copy packet sections to the Android clipboard, you must also install the Termux:API app from the Play Store and the termux-api package in Termux.

    # Install Termshark (requires root-repo for tshark)
pkg install root-repo
pkg install termshark

# Install Termux:API for clipboard support
pkg install termux-api

  4. Capture from extcap interfaces on Windows

    master
    Termshark automatically uses dumpcap for live captures on Unix-like systems, but on Windows, it defaults to dumpcap which may not support extcap interfaces. To read extcap interfaces on Windows, you must manually set the capture-command to tshark in your Termshark TOML configuration file.

  5. Apply display filters in Termshark

    master
    To filter packets, press / to focus on the display filter widget. You can type Wireshark display filter expressions. The UI provides real-time validity feedback: the widget turns green if the expression is valid and red if it is invalid. A drop-down menu with completions is available as you type. Once the expression is valid (green), press the "Apply" button to reload the packets with the new filter.

  6. Install Termshark via SnapCraft

    master

    Termshark can be installed on most major distributions using Snap.

    Important Limitation: Due to Snap and Wireshark architecture constraints, the Snap version cannot read live network interfaces. It can only be used to inspect .pcap files.

    snap install termshark

  8. Manage Termshark Profiles

    master

    Termshark v2.4+ supports Wireshark-like profiles. Each profile is a separate TOML file stored in $XDG_CONFIG_HOME/termshark/profiles/<profile_name>/termshark.toml. Settings in a profile take precedence over the default termshark.toml.

    • Create a profile: Run profile create in the command line and follow the dialog to name it.
    • Link to a Wireshark profile: You can link a Termshark profile to an existing Wireshark profile (e.g., wshark). This causes tshark to run with the -C <profile_name> flag, allowing Termshark to use Wireshark's packet coloring rules.
    • Switch profiles: Use the profile use command to switch between configured profiles.
    • Manage links: Use profile link and profile unlink to change the associated Wireshark profile.

    Note: When creating a new profile, its settings are initialized as a copy of the currently active profile.

  9. Run Termshark in a specific TTY

    master
    To avoid terminal conflicts, you can launch Termshark in a specific TTY, which is useful when using terminal multiplexers like tmux. First, identify the TTY of a target pane, then pass it to Termshark using the --tty flag.

  10. Configure Packet Colors

    master

    By default, Termshark displays packets in the packet list view using Wireshark's default color rules (sourced from tshark).

    • Enable/Disable: You can toggle packet colorization via the Termshark main menu.
    • Configuration: Colors are provided by tshark and cannot be edited directly within Termshark. If you have a Wireshark installation, Termshark uses the color filters found at $XDG_CONFIG_HOME/wireshark/colorfilters.