Wireshark · Wireshark-users: [Wireshark-users] termshark: a terminal UI for tshark

[Graham Clark <grclark@xxxxxxxxx>]

Hi everyone - I thought you might be interested in this spare-time project:

https://termshark.io

In my professional life I quite often find myself on a remote machine

debugging something, and with a need to look at a pcap. I wrote termshark to

make it easy to scan the pcap immediately and to avoid having to scp it

around.  Behind the scenes, tshark provides all the intelligence, so termshark

depends on tshark being installed. Termshark runs the input pcap through

tshark, and uses the PDML and PSML to provide Wireshark-like views of each

packet. Currently you can view a pcap, sniff on an interface (if permissions

allow), and filter using Wireshark's display filters. There's so much more it

could do easily through tshark, like stream reassembly, display of

conversations, statistics, etc, but I wanted to push out v1 so this is where I

drew the line.

Termshark is written in Go and makes heavy use of the excellent tcell library

for control of the terminal. Because Go is so naturally portable, there are

versions of termshark on github for Linux (+termux/Android), FreeBSD, macOS

and even Windows.

The source code with build instructions is here: https://github.com/gcla/termshark

I hope you find it useful, and I'm very interested to hear your feedback.

Graham