# termshark

> Terminal user interface for tshark that provides Wireshark-like packet analysis capabilities from the command line

Stars: 10.1k · Language: Go · License: MIT · Categories: Network

- Repository: https://github.com/gcla/termshark
- Page: https://www.trmn.sh/tools/termshark

## Install

- Go: `go install github.com/gcla/termshark/v2/cmd/termshark@v2.4.0`
- Homebrew: `brew install termshark`

## Overview

Termshark is a terminal-based network packet analyzer that wraps tshark with a Wireshark-inspired user interface. It reads pcap files and captures live network traffic, displaying packets in an interactive TUI that supports Wireshark's display filters for packet analysis. The tool can reassemble and inspect TCP/UDP flows, view network conversations by protocol, and copy packet ranges to the clipboard directly from the terminal.

Built in Go, termshark compiles to a single executable and runs on Linux, macOS, BSD variants, Android (via Termux), and Windows. It requires tshark (version 1.10.2 or higher) as a runtime dependency and must be in the system PATH. The tool is particularly useful for debugging network issues on remote machines where transferring large pcap files is impractical, allowing analysis directly on the target system.

Termshark supports both offline analysis of existing pcap files and live capture from network interfaces where tshark has appropriate permissions. Recent versions include packet search functionality and customizable profiles for colors and columns, expanding its analysis capabilities beyond basic packet inspection.

### Installation

```bash
# via Go
go install github.com/gcla/termshark/v2/cmd/termshark@v2.4.0
```

```bash
# via Homebrew
brew install termshark
```

![Termshark demo showing packet analysis interface](https://media.trmn.sh/cached/48cb81b9336e38ba18daf472e639361dfedfab050eaa437aa793e560968fa969.gif)

## Alternatives

- [qrcp](https://www.trmn.sh/tools/qrcp.md): Go CLI that transfers files between a computer and a mobile device over Wi-Fi by printing a QR code in the terminal that links to a temporary local web server. (Go, 10.5k stars)
- [httpx](https://www.trmn.sh/tools/httpx.md): HTTP probing CLI from ProjectDiscovery that takes hosts, URLs or CIDRs and reports status, title, TLS, tech stack, CDN and more, with matchers and filters. (Go, 10.6k stars)
- [wuzz](https://www.trmn.sh/tools/wuzz.md): Interactive terminal UI for inspecting and editing HTTP requests and responses, with cURL-style arguments and regex, HTML and JSON response filtering. (Go, 10.7k stars)
- [wego](https://www.trmn.sh/tools/wego.md): Terminal weather client showing 1–7 day forecasts from several backends, rendered as an ASCII-art table, emoji, markdown, or JSON. (Go, 8.6k stars)
- [bombardier](https://www.trmn.sh/tools/bombardier.md): HTTP(S) benchmarking tool written in Go that uses fasthttp by default, with optional net/http for HTTP/2, and reports latency, requests/sec and throughput. (Go, 6.8k stars)

---

Canonical: https://www.trmn.sh/tools/termshark