Ettercap vs termshark
Ettercap
ettercap-project.orgtermshark
github.comSide by side
| Figure | Ettercap | termshark |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | — |
| Windows | — | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Android | — | Yes |
| Self-hosted | Yes | — |
| Plans published | 1 | 1 |
| Spec score · Network Protocol Analyzers | 8.0 (#13) | 8.2 (#9) |
| Filtering | Its integrated filtering engine lets users write filters that can modify packet payloads; filters are compiled with etterfilter. | It filters packet captures and live captures using Wireshark display filters. |
| Purpose | Ettercap is a suite for man-in-the-middle testing with live connection sniffing, on-the-fly content filtering, protocol dissection, and network and host analysis. | Termshark is a terminal user interface for tshark, inspired by Wireshark. |
| Release | The downloads page lists version 0.8.4.1-Garofalo, released April 7, 2026, as the latest release. | The latest listed release is v2.4.0, released on July 11, 2022. |
Plans
In their own words
Ettercap
Ettercap is a free, open-source suite for man-in-the-middle testing, live connection sniffing and network analysis. It dissects protocols actively or passively, filters packet payloads through compiled etterfilter rules, and performs network and host analysis. Passive LAN scanning can extract host, operating-system, port and gateway information from observed traffic. Command-line, graphical and ncurses interfaces are available, along with PCAP support, remote capture, traffic decryption and flow analysis. The project lists Linux and macOS platforms and supports self-hosted deployment. Tested systems include Debian/Ubuntu, Fedora, Gentoo, Pentoo, Mac OS X, FreeBSD, OpenBSD and NetBSD. The latest listed release is 0.8.4.1-Garofalo, released April 7, 2026, with a fix for an etterfilter heap out-of-bounds read identified as CVE-2026-3606. Downloads include SHA256 checksums. Source builds require libraries and tools such as libpcap, libnet, pthread, zlib, CMake, Flex and Bison. The project is community run under GPL-2.0.
termshark
termshark is a terminal interface for tshark, inspired by Wireshark, for inspecting packet captures and network traffic. It can read pcap files or sniff live interfaces when tshark is permitted, including on a remote machine where a capture need not be copied to a desktop. Users can apply Wireshark display filters, group conversations by protocol, and reassemble TCP and UDP streams. Packet search covers packet lists, structures and bytes, using text, regular expressions, hexadecimal input or display filters. The guide also describes importing a Wireshark column set when the configuration can be found, and transferring the current capture with Magic Wormhole. The project lists Linux, macOS, BSD variants, Android through Termux and Windows. It is free and MIT-licensed, and the project says its Go implementation builds as one executable on each platform. Packet analysis requires tshark 1.10.2 or higher in the user's PATH. The project notes that some tshark features are not yet exposed by termshark; the latest listed release is v2.4.0, dated July 11, 2022.