Termshark is also on Homebrew for macOS users. Or you can build it yourself if you prefer. The Termshark releases page has binaries for Linux (圆4 and armv6), macOS and Windows. On Windows, Termshark no longer depends on the Cywgin tail command, and thus on a Cygwin installation.įor a bit more about Termshark, read: Analyze Network Traffic With Termshark, A Terminal UI For TShark (Wireshark) You can now simply hit enter in the display filter widget to make its value take effectĪlso, with this release it's now possible to install Termshark on macOS using Homebrew.Termshark can be configured to eagerly load all pcap PDML data, rather than 1000 packets at a time.The current packet capture source (file, interface, pipe, etc) is displayed in the Termshark title bar.Termshark now respects job control signals sent via the shell i.e.This lets the user see differences between packets more easily Like Wireshark, Termshark will now preserve the opened and closed structure of a packet as you move from one packet to the next.

The Termshark UI can now run on a different tty, e.g.

to pipe the tshark input: tshark -i eth0 -w - | termshark

Termshark can be configured to auto-scroll when reading live data (interface, fifo or stdin).

The default mode continues to use a white background.

Termshark now has a dark mode in which it uses a dark background.

To access this feature head to the Analysys menu and press f or click the Reassemble stream menu item

Support for TCP and UDP stream reassembly.

There are also quite a few new features in the latest Termshark 2.0.0 too: The application now uses less CPU, is less laggy under mouse input, and will use less than half as much RAM on larger pcaps. The latest Termshark 2.0 includes some important performance improvements. But TShark doesn't have an interactive terminal user interface (TUI), and this is where Termshark comes in - it's an interactive terminal interface for TShark that tries to copy the Wireshark layout.

Wireshark, the free and open source network protocol analyzer, already has a terminal version - TShark.

Tshark linux