Skip to content
SPECIFICTION
Get listed

termshark

github.com

Free plan WindowsmacOSLinuxAndroid
Visit github.com
Spec score 8.2 #9 of 30 in Network Protocol Analyzers

What it is

termshark is a terminal interface for tshark, inspired by Wireshark, for inspecting packet captures and network traffic. It can read pcap files or sniff live interfaces when tshark is permitted, including on a remote machine where a capture need not be copied to a desktop. Users can apply Wireshark display filters, group conversations by protocol, and reassemble TCP and UDP streams. Packet search covers packet lists, structures and bytes, using text, regular expressions, hexadecimal input or display filters. The guide also describes importing a Wireshark column set when the configuration can be found, and transferring the current capture with Magic Wormhole. The project lists Linux, macOS, BSD variants, Android through Termux and Windows. It is free and MIT-licensed, and the project says its Go implementation builds as one executable on each platform. Packet analysis requires tshark 1.10.2 or higher in the user's PATH. The project notes that some tshark features are not yet exposed by termshark; the latest listed release is v2.4.0, dated July 11, 2022.

Spec sheet

Purpose
Termshark is a terminal user interface for tshark, inspired by Wireshark.Read 7 Oct 2026 · github.com
Support
The repository links a user guide and FAQ for documentation.Read 7 Oct 2026 · github.com
License
The repository identifies the project as MIT licensed.Read 7 Oct 2026 · github.com
Capture and files
Termshark can read pcap files and sniff live interfaces.Read 7 Oct 2026 · termshark.io
Capture permissions
Live interface sniffing is available where tshark is permitted.Read 7 Oct 2026 · github.com
Conversations
It can show network conversations grouped by protocol.Read 7 Oct 2026 · github.com
Dependencies
Termshark depends on tshark for packet analysis, and tshark must be in the user's PATH.Read 7 Oct 2026 · github.com
Designed for
The project describes use for debugging on a remote machine when a large pcap need not be copied back to a desktop.Read 7 Oct 2026 · github.com
Filtering
It filters packet captures and live captures using Wireshark display filters.Read 7 Oct 2026 · github.com
Filters
Termshark supports Wireshark display filters.Read 7 Oct 2026 · termshark.io
Flow inspection
It can reassemble and inspect TCP and UDP flows.Read 7 Oct 2026 · github.com
Integration
Termshark depends on tshark from the Wireshark project for packet analysis and requires tshark in PATH.Read 7 Oct 2026 · github.com
Known limitation
The project says tshark has features that termshark does not yet expose.Read 7 Oct 2026 · github.com
License and warranty
The software is distributed under the MIT License and provided without warranty.Read 7 Oct 2026 · github.com
Notable limit
The repository notes that tshark has features that termshark does not yet expose.Read 7 Oct 2026 · github.com
Packet input
It can read pcap files or sniff live interfaces when tshark is permitted.Read 7 Oct 2026 · github.com
Packet search
The user guide says packet search can search packet-list, packet-structure, and packet-byte data using strings, regular expressions, hexadecimal input, or display filters.Read 7 Oct 2026 · github.com
Platform builds
The README lists downloads for Linux, macOS, BSD variants, Android through Termux, and Windows.Read 7 Oct 2026 · github.com
Platform support
The project lists Linux, macOS, BSD variants, Android through Termux, and Windows as supported platforms.Read 7 Oct 2026 · termshark.io
Release
The latest listed release is v2.4.0, released on July 11, 2022.Read 7 Oct 2026 · github.com
Search and profiles
The v2.4.0 release added packet search and profiles for colors and columns.Read 7 Oct 2026 · github.com
Single executable
The project says its Go implementation compiles to a single executable on each platform.Read 7 Oct 2026 · github.com
Streams
Termshark can reassemble TCP and UDP streams.Read 7 Oct 2026 · termshark.io
Transfer
The user guide lists a command to transfer the current pcap using Magic Wormhole.Read 7 Oct 2026 · github.com
Use case
The project describes using termshark to analyze a packet capture on a remote machine without copying it to a desktop.Read 7 Oct 2026 · termshark.io

Plans and prices

termshark Free MIT-licensed · Requires tshark 1.10.2 or higher Read 7 Oct 2026 · github.com

Every termshark plan and price →

Strong points and limits

Strong points

  • Reads pcap files and can sniff live interfaces
  • Supports Wireshark display filters
  • Can inspect TCP and UDP streams
  • Packet search supports text, regex and hexadecimal input
  • Runs on Linux, macOS, BSD, Android through Termux and Windows

Limits

  • Requires tshark 1.10.2 or higher in PATH
  • Some tshark features are not exposed
  • Live sniffing depends on tshark permission
  • Latest listed release dates to July 11, 2022

Who it suits

termshark suits users who want to inspect packet captures in a terminal, including when analyzing them on a remote machine. It requires tshark to be available and permitted for the intended capture task.

Verdict

termshark brings packet inspection and filtering to a terminal, including remote-capture use. Its reliance on tshark and the features it does not expose are important constraints to check first.

Where Specifiction places it

Alternatives to termsharkAll alternatives →