Termshark vs TShark

Termshark is a terminal interface for tshark, inspired by Wireshark, for inspecting saved packet captures and live network traffic. It can read pcap files and sniff live interfaces when tshark permits, then apply Wireshark display filters to either. Users can inspect and reassemble TCP and UDP flows, search packets, copy packet ranges, and view conversations involving Ethernet, IPv4, IPv6, UDP, and TCP. Version 2.4 added packet search and profiles for colors and columns. It supports 16-color, 256-color, and truecolor terminal modes. The project lists Linux, macOS, BSD variants, Android through Termux, and Windows, with precompiled executables available through GitHub releases. Termshark is aimed at remote debugging where a large capture can be examined on the remote machine rather than copied to a desktop. It is free and MIT licensed. Packet analysis requires tshark 1.10.2 or newer in PATH; the project notes that tshark has features Termshark does not expose.

TShark is the Wireshark project's terminal-mode utility for capturing and analyzing network traffic. It can capture live packets or read saved captures, decode packet data for output, and write captures to a file. Its native capture format is pcapng, and it can read and write formats supported by Wireshark. Display filters use Wireshark syntax to select packets and protocol fields. Output formats include fields, JSON, PDML, and text; capture controls include interface selection, capture filters, packet limits, and ring-buffer files. TShark can write ElasticSearch mapping data or pipe packet output to another program or script. One constraint is that display filters are unavailable when capturing and saving packets with the -w option. The manual sets a 2 TB maximum capture-file size and notes potential issues above 2^32 packets. The Wireshark project is maintained by the Wireshark Foundation, a nonprofit supported by donations. TShark is free under GNU GPL version 2 and runs on Linux, macOS, and Windows.