Termshark

Overview

Termshark is a terminal interface for tshark that brings packet inspection to machines where a desktop analyzer may be inconvenient. It suits network troubleshooters working on remote hosts and anyone who wants to examine pcaps without leaving a terminal. Its useful core comes at a clear cost: tshark must be installed, and its full feature set is not exposed.

Key features

Termshark reads pcap files and can sniff live interfaces when tshark has permission. Wireshark display filters work on both saved traces and live captures, making it possible to narrow traffic without moving the analysis into a graphical application. For remote debugging, that can avoid copying a large capture to a desktop.

It can reassemble and inspect TCP and UDP flows. The conversation view covers Ethernet, IPv4, IPv6, UDP, and TCP, while packet search and packet-range copying support focused investigation. Profiles save color and column settings; terminal display supports 16-color, 256-color, and truecolor modes.

This remains an interface to tshark, not a substitute for its full capabilities. Packet data loaded into Termshark uses approximately 10 MB of RAM per 1,000 packets, a useful consideration when reviewing large captures on resource-constrained machines.

Pricing

Termshark is free: the Termshark plan costs nothing. It includes live capture, offline trace analysis, display filters, pcap support, and command-line capture. There are no paid tiers to unlock; the trade-off is the dependency on tshark and the narrower set of features exposed through Termshark.

Platforms

Downloads cover Linux, macOS, BSD variants, Windows, and Android through Termux. Precompiled executables are available through GitHub releases. Packet analysis requires tshark 1.10.2 or newer in the PATH, and live capture additionally depends on tshark being permitted to access the interface. The project points users to GitHub for setup help, bug reports, and feature requests. The software is MIT licensed.

Who it's for

Termshark is a strong fit for engineers and administrators diagnosing network problems on remote machines, especially when the capture is large enough that transferring it to a desktop is undesirable. It also suits users who want a terminal workflow for common pcap filtering and flow inspection. Choose another tool if your work depends on functions that tshark provides but Termshark does not expose, or if installing and configuring tshark is not practical.

Pros and cons

Pros: Works with saved pcaps and live interfaces; Wireshark display filters support both modes; remote-host analysis avoids copying large captures; stream inspection, packet search, and conversation views bring useful analysis into a terminal.

Cons: Requires tshark 1.10.2 or newer in the PATH; live capture depends on permissions; the conversation view covers a defined set of protocols; tshark has capabilities Termshark does not expose; loaded packet data consumes roughly 10 MB per 1,000 packets.

Alternatives

Compare network packet capture software if you want to consider the wider category.

Malcolm is a free, self-hosted option for readers who want a broader platform footprint, including web access.

NetworkMiner is a freemium, GPLv2 open-source alternative for readers who prefer its managed C# and.NET Framework codebase.

Colasoft Capsa is a Windows freemium option; its free plan caps monitoring at 10 IP addresses and sessions at four hours, while Professional costs $695, paid once.

Sniffnet is a free, open-source option for Linux, macOS, or Windows if you want a different cross-platform packet-analysis tool.

Arkime is a free, open-source choice for Linux and self-hosted web or API deployments.

tcpdump is a free option for readers who want a BSD-licensed tool, with capture permissions depending on operating system and configuration.

TShark is the direct choice if you need the broader functionality Termshark does not expose; it is free and GPL v2.

Verdict

Choose Termshark when you need to inspect pcaps or troubleshoot live traffic on a remote machine through a terminal, and value avoiding capture-file transfers over having every tshark feature at hand. Look elsewhere when the missing tshark functionality or the runtime dependency would constrain your analysis.