The interactive network traffic analyzer includes some handy keyboard shortcuts, like / to go to the display filter, TAB to switch panes, c to switch to copy-mode, etc. The developer plans to improve Termshark, with quite a few features being planned, like the ability to select a packet and display the reassembled stream, show pcap statistics, colorize the packets in the packet list view using the Wireshark coloring rules, and more. I preferred not to add it to this article as it's a bit too large (3mb). If you want to see it in action, there's a Termshark GIF on its homepage.

Copy ranges of packets to the clipboard from the terminal.

Filter pcaps or live captures using Wireshark's display filters.

Inspect each packet using familiar Wireshark-inspired views.

Read pcap files or sniff live interfaces (where TShark is permitted).

The command line tool had its first release a few days ago, so don't expect it to support all of TShark's features just yet. Its interactive terminal interface uses tcell, a cell-based terminal handling package inspired by termbox, and gowid, a Go package that provides widgets and a framework for making terminal user interfaces.

Termshark is written in Go, and makes use of TShark which is part of Wireshark. TShark doesn't have an interactive terminal user interface though, and this is where Termshark comes in. TShark is a terminal version of Wireshark, the free and open source packet analyzer used for network troubleshooting, analysis, software and communication protocol development.

Termshark is a new terminal user interface for TShark (network protocol analyzer), inspired by Wireshark.

Wireshark linux mint