# termshark

> Graham Clark's terminal user interface for tshark, inspired by Wireshark and aimed at inspecting captures on a remote machine, for example over SSH, without copying them back to a desktop. It reads pcap files, fifos or standard input, or captures live from one or more interfaces, and shows a packet list filtered with Wireshark display filters next to the dissected packet structure and a hex view. Analysis views reassemble TCP and UDP streams with search and client- or server-only display, list Ethernet, IPv4, IPv6, UDP and TCP conversations that can be turned into display filters, and search packet contents; Wireshark-style profiles can reuse a linked Wireshark profile's packet colors.

- Type: Tool
- Targets: Protocol
- Category: Protocol analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-10-27
- Added to the catalog: 2026-11-03
- Original resource: <https://github.com/gcla/termshark>
- Primary source: <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/README.md>
- Catalog page: <https://awesomerea.org/resources/termshark/>
- Record JSON: <https://awesomerea.org/resources/termshark/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/termshark/index.md)

## Requirements & limits

- Latest release at review: v2.4.0, published 2022-07-11, with builds for Linux (x64, arm64, armv6), macOS (x64, arm64), FreeBSD, NetBSD, OpenBSD and Windows x64. The README also lists Arch, Debian, FreeBSD, Homebrew, MacPorts, Kali, NixOS, Snapcraft, Termux and Ubuntu packages. The reviewed master commit (2022-11-01) is 14 commits ahead of that release, including unreleased hex-view navigation changes, and master has had no commits since.
- tshark from Wireshark, version 1.10.2 or later, must be on PATH at run time, because termshark relies on it for all packet analysis; protocol coverage is therefore whatever the installed tshark dissects. Live capture uses dumpcap and works only where the user is permitted to capture. By default, captured packets are saved in the user's cache directory (.cache/termshark/pcaps on Linux), or to a file given with -w. Copying packets to the clipboard over SSH needs X11 forwarding or a custom copy command.
- Builds as a single Go executable with go install (module github.com/gcla/termshark/v2; go.mod declares Go 1.13). Besides theme files, the repository commits only small test captures (pkg/pcap/testdata and scripts/pcaps/telnet-cooked.pcap).
- MIT license. The README notes that tshark has many features termshark does not expose yet.

## Primary sources

1. <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/README.md>
2. <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/docs/UserGuide.md>
3. <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/docs/UserGuide.md#L87-L195>
4. <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/docs/UserGuide.md#L313-L360>
5. <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/docs/Packages.md>
6. <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/CHANGELOG.md>
7. <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/go.mod>
8. <https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/LICENSE>
9. <https://github.com/gcla/termshark/releases/tag/v2.4.0>

## More in Protocols

- [SigDigger](https://awesomerea.org/resources/sigdigger/index.md) · Tool
- [grpc-tools](https://awesomerea.org/resources/grpc-tools/index.md) · Tool
- [Holley EFI Parser](https://awesomerea.org/resources/holley-efi-parser/index.md) · Tool
- [CAN Bus Parser](https://awesomerea.org/resources/vanmoof-can-bus-parser/index.md) · Tool
- [Lutron Protocols](https://awesomerea.org/resources/lutron-protocols/index.md) · Project
- [Hermes](https://awesomerea.org/resources/hermes-flipperzero/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.