Termshark vs Wireshark
Termshark
termshark.ioWireshark
wireshark.orgSide by side
| Figure | Termshark | Wireshark |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | — | — |
| Open source | — | Yes |
| Windows | Yes | Yes |
| macOS | Yes | Yes |
| Linux | Yes | Yes |
| Android | Yes | — |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 2 |
| Spec score · Network Packet Capture Software | 8.0 (#7) | 8.2 (#6) |
| Filtering | It supports Wireshark display filters for pcap files and live captures. | Users can filter packets using many criteria, including display filters for addresses, ports and protocols. |
| License | The GitHub repository identifies the project as MIT licensed. | Wireshark is open-source software released under the GNU General Public License version 2, and the downloaded version is the full version without a license fee. |
| Purpose | Termshark is a terminal user interface for tshark, inspired by Wireshark. | Wireshark captures and interactively browses network traffic as a network protocol analyzer. |
| Support | The homepage directs users to GitHub for setup, bugs, and feature requests. | Community support is available through the Q&A site and Wireshark users mailing list. |
Plans
In their own words
Termshark
Termshark is a terminal interface for tshark, inspired by Wireshark, for inspecting saved packet captures and live network traffic. It can read pcap files and sniff live interfaces when tshark permits, then apply Wireshark display filters to either. Users can inspect and reassemble TCP and UDP flows, search packets, copy packet ranges, and view conversations involving Ethernet, IPv4, IPv6, UDP, and TCP. Version 2.4 added packet search and profiles for colors and columns. It supports 16-color, 256-color, and truecolor terminal modes. The project lists Linux, macOS, BSD variants, Android through Termux, and Windows, with precompiled executables available through GitHub releases. Termshark is aimed at remote debugging where a large capture can be examined on the remote machine rather than copied to a desktop. It is free and MIT licensed. Packet analysis requires tshark 1.10.2 or newer in PATH; the project notes that tshark has features Termshark does not expose.
Wireshark
Wireshark is a free network protocol analyzer for capturing and examining network traffic. It supports live capture and offline analysis through a graphical interface or the TShark terminal utility, and can inspect hundreds of protocols. Display filters narrow what appears during analysis, though their syntax differs from capture filters. Wireshark reads and writes capture formats including pcap and pcapng, and can decompress gzip-compressed files. Analysis features include VoIP tools, packet coloring rules, and exports to XML, PostScript, CSV, or plain text. It can decrypt traffic for protocols including IPsec, Kerberos, SSL/TLS, WEP, and WPA/WPA2. The software is available for Linux, macOS, and Windows under GNU General Public License version 2, with no license fee for the full version. Windows packages include Npcap, which is needed for live packet capture. What a capture can show depends on the operating system, capture library, network interface, and network configuration; switched networks may not expose unicast traffic between other ports. Community help is available through a Q&A site and users mailing list.