{
  "added_at": "2026-11-03",
  "additional_evidence_urls": [
    "https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/docs/UserGuide.md",
    "https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/docs/UserGuide.md#L87-L195",
    "https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/docs/UserGuide.md#L313-L360",
    "https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/docs/Packages.md",
    "https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/CHANGELOG.md",
    "https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/go.mod",
    "https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/LICENSE",
    "https://github.com/gcla/termshark/releases/tag/v2.4.0"
  ],
  "category": "protocol-analysis",
  "description_en": "Graham Clark's terminal user interface for tshark, inspired by Wireshark and aimed at inspecting captures on a remote machine, for example over SSH, without copying them back to a desktop. It reads pcap files, fifos or standard input, or captures live from one or more interfaces, and shows a packet list filtered with Wireshark display filters next to the dissected packet structure and a hex view. Analysis views reassemble TCP and UDP streams with search and client- or server-only display, list Ethernet, IPv4, IPv6, UDP and TCP conversations that can be turned into display filters, and search packet contents; Wireshark-style profiles can reuse a linked Wireshark profile's packet colors.",
  "description_zh": "Graham Clark 开发的 tshark 终端界面，设计上参考 Wireshark，便于在远程机器上（例如通过 SSH）直接检查抓包文件，而不必先拷回桌面。它可读取 pcap 文件、fifo 或标准输入，也可从一个或多个网络接口实时抓包；界面在按 Wireshark 显示过滤器筛选的数据包列表旁，同时显示解析后的数据包结构和十六进制视图。分析视图可以重组 TCP 和 UDP 流，支持搜索并可只看客户端或服务端数据；还能列出 Ethernet、IPv4、IPv6、UDP 和 TCP 会话并据此生成显示过滤器，以及搜索数据包内容。类似 Wireshark 的配置方案可以关联 Wireshark 配置，沿用其中的数据包着色规则。",
  "entry_url": "https://awesomerea.org/resources/termshark/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/termshark/",
  "evidence_url": "https://github.com/gcla/termshark/blob/e8a1ec6e4f2d517f646d3bba35a2ec4926e0202c/README.md",
  "group": "tools",
  "id": "termshark",
  "json_url": "https://awesomerea.org/resources/termshark/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/termshark/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/termshark/index.md",
  "name": "termshark",
  "name_zh": "termshark tshark 终端界面",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v2.4.0, published 2022-07-11, with builds for Linux (x64, arm64, armv6), macOS (x64, arm64), FreeBSD, NetBSD, OpenBSD and Windows x64. The README also lists Arch, Debian, FreeBSD, Homebrew, MacPorts, Kali, NixOS, Snapcraft, Termux and Ubuntu packages. The reviewed master commit (2022-11-01) is 14 commits ahead of that release, including unreleased hex-view navigation changes, and master has had no commits since.",
    "tshark from Wireshark, version 1.10.2 or later, must be on PATH at run time, because termshark relies on it for all packet analysis; protocol coverage is therefore whatever the installed tshark dissects. Live capture uses dumpcap and works only where the user is permitted to capture. By default, captured packets are saved in the user's cache directory (.cache/termshark/pcaps on Linux), or to a file given with -w. Copying packets to the clipboard over SSH needs X11 forwarding or a custom copy command.",
    "Builds as a single Go executable with go install (module github.com/gcla/termshark/v2; go.mod declares Go 1.13). Besides theme files, the repository commits only small test captures (pkg/pcap/testdata and scripts/pcaps/telnet-cooked.pcap).",
    "MIT license. The README notes that tshark has many features termshark does not expose yet."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v2.4.0，发布于 2022-07-11，提供 Linux（x64、arm64、armv6）、macOS（x64、arm64）、FreeBSD、NetBSD、OpenBSD 和 Windows x64 构建。README 还列出了 Arch、Debian、FreeBSD、Homebrew、MacPorts、Kali、NixOS、Snapcraft、Termux 和 Ubuntu 软件包。所审阅的 master 提交（2022-11-01）比该版本多 14 个提交，其中包括尚未发布的十六进制视图导航改进；此后 master 再无新提交。",
    "运行时需要 PATH 中有 Wireshark 的 tshark（1.10.2 或更高版本），因为 termshark 的全部数据包分析都依赖它，能解析哪些协议也取决于所安装的 tshark。实时抓包使用 dumpcap，只能在用户有抓包权限的环境中进行。抓到的数据包默认保存在用户的缓存目录中（Linux 上为 .cache/termshark/pcaps），也可用 -w 指定文件。通过 SSH 把数据包复制到剪贴板时，需要 X11 转发或自定义复制命令。",
    "可用 go install 构建为单个 Go 可执行文件（模块为 github.com/gcla/termshark/v2，go.mod 声明 Go 1.13）。除主题文件外，仓库只提交了少量小型测试抓包文件（pkg/pcap/testdata 和 scripts/pcaps/telnet-cooked.pcap）。",
    "采用 MIT 许可。README 指出，tshark 的许多功能 termshark 尚未提供。"
  ],
  "targets": [
    "protocol"
  ],
  "url": "https://github.com/gcla/termshark",
  "verification": "source-reviewed",
  "verified_at": "2026-10-27"
}