Termshark

Termshark is a terminal-based network packet analyzer and protocol flow inspector. It serves as a keyboard-driven interface for the tshark command-line utility, providing a terminal user interface to monitor data flow and analyze network traffic.

The tool functions as a terminal interface for Wireshark, utilizing its filtering and inspection logic to analyze recorded capture files or live network interfaces. It specifically enables the reassembly and inspection of TCP and UDP flows to isolate traffic patterns and analyze network conversations by protocol.

The system includes capabilities for packet capture filtering to isolate specific data based on defined criteria and supports exporting selected packet ranges to the system clipboard for external analysis.

Features

Terminal User Interfaces - Renders network data as an interactive terminal user interface by mapping packet structures to grid-based text layouts.
Network Flow Analyzers - Reassembles and structures network traffic into stateful flows to analyze conversations organized by protocol.
Network Traffic Analyzers - Serves as a terminal-based tool for capturing, inspecting, and debugging network protocols and communication streams.
Network Traffic Inspectors - Provides a terminal interface for examining raw network request and response data from live or recorded sources.
Packet Capture Engines - Uses a libpcap-based engine to capture raw network traffic from interfaces or read capture files.
Stream Reassemblers - Reconstructs fragmented network conversations into coherent protocol flows by tracking sequence numbers and offsets.
TCP Session Management - Reassembles and views TCP and UDP network conversations to debug communication issues between hosts.
Display Filters - Processes traffic streams through a logical filter engine to isolate packets matching specific protocol or address criteria.
Packet Inspection - Performs deep analysis of network packets and protocol headers using the logic associated with the Wireshark protocol.
TUI Wrappers - Provides a keyboard-driven terminal interface for the tshark command-line utility to visualize network packets.
Network Infrastructure - Terminal-based interface for network packet analysis.
Networking Tools - Terminal UI for network packet analysis.
Network Security and Proxies - Terminal-based UI for network protocol analysis.

Star history

gclatermshark

Name: gcla/termshark
Author: gcla

View on GitHub

9,908 stars436 forksGoMIT13 views

Termshark

Features

Terminal User Interfaces - Renders network data as an interactive terminal user interface by mapping packet structures to grid-based text layouts.
Network Flow Analyzers - Reassembles and structures network traffic into stateful flows to analyze conversations organized by protocol.
Network Traffic Analyzers - Serves as a terminal-based tool for capturing, inspecting, and debugging network protocols and communication streams.
Network Traffic Inspectors - Provides a terminal interface for examining raw network request and response data from live or recorded sources.
Packet Capture Engines - Uses a libpcap-based engine to capture raw network traffic from interfaces or read capture files.
Stream Reassemblers - Reconstructs fragmented network conversations into coherent protocol flows by tracking sequence numbers and offsets.
TCP Session Management - Reassembles and views TCP and UDP network conversations to debug communication issues between hosts.
Display Filters - Processes traffic streams through a logical filter engine to isolate packets matching specific protocol or address criteria.
Packet Inspection - Performs deep analysis of network packets and protocol headers using the logic associated with the Wireshark protocol.
TUI Wrappers - Provides a keyboard-driven terminal interface for the tshark command-line utility to visualize network packets.
Network Infrastructure - Terminal-based interface for network packet analysis.
Networking Tools - Terminal UI for network packet analysis.
Network Security and Proxies - Terminal-based UI for network protocol analysis.

Open-source alternatives to Termshark

Similar open-source projects, ranked by how many features they share with Termshark.

wireshark/wireshark
wireshark/wireshark
9,477View on GitHub
Wireshark is a network protocol analyzer and traffic inspector used for capturing and inspecting network traffic. It functions as a packet capture tool that intercepts live data from network interfaces and a TCP/IP dissector that decodes network protocol layers to translate raw binary packets into human-readable fields. The system provides capabilities for protocol stream reconstruction, grouping related packets into cohesive conversations between endpoints. It also operates as a packet file converter, allowing for the reading, modification, and conversion of network capture files across vari
Cpacket-capturestratosharktshark
View on GitHub9,477
iovisor/bcc
iovisor/bcc
22,459View on GitHub
BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It functions as a performance analysis tool and debugging utility to capture system events, measure kernel latency, and provide network observability. The project distinguishes itself by providing a build system that integrates with LLVM to compile C-like code into BPF bytecode at runtime. It utilizes BPF Type Format data for relocations to maintain cross-kernel compatibility and extracts kernel headers to ensure the generated programs match the specific kernel version. The toolkit co
C
View on GitHub22,459
mitmproxy/mitmproxy
mitmproxy/mitmproxy
43,943View on GitHub
Mitmproxy is an interactive, programmable network proxy engine designed for traffic analysis and protocol manipulation. It functions as a gateway that intercepts, inspects, and modifies network traffic in real-time, supporting HTTP, HTTPS, WebSocket, DNS, and generic TCP or UDP streams. By acting as a trusted certificate authority, the proxy can dynamically generate and sign certificates to decrypt and analyze secure TLS-encrypted connections. The project distinguishes itself through a highly extensible, event-driven architecture that allows users to automate traffic transformation using cust
Pythondebugginghttphttp2
View on GitHub43,943
secdev/scapy
secdev/scapy
12,068View on GitHub
Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and dissecting network traffic. It functions as a framework for building custom network tools that interact directly with low-level packet headers and payloads, enabling users to perform security research and network diagnostics. The system distinguishes itself through a layer-based construction model that allows users to define protocols as stacked objects, which automatically handle checksums and field offsets. It utilizes dynamic field reflection to map packet structures to bin
Pythonhacktoberfestnetworknetwork-analysis
View on GitHub12,068

See all 30 alternatives to Termshark

Frequently asked questions

What does gcla/termshark do?

What are the main features of gcla/termshark?

The main features of gcla/termshark are: Terminal User Interfaces, Network Flow Analyzers, Network Traffic Analyzers, Network Traffic Inspectors, Packet Capture Engines, Stream Reassemblers, TCP Session Management, Display Filters.

What are some open-source alternatives to gcla/termshark?

Open-source alternatives to gcla/termshark include: wireshark/wireshark — Wireshark is a network protocol analyzer and traffic inspector used for capturing and inspecting network traffic. It… iovisor/bcc — BCC is an eBPF development toolkit and tracing framework used for monitoring and analyzing the Linux kernel. It… mitmproxy/mitmproxy — Mitmproxy is an interactive, programmable network proxy engine designed for traffic analysis and protocol… secdev/scapy — Scapy is a network packet manipulation tool and protocol analysis suite designed for crafting, sending, sniffing, and… gyulyvgc/sniffnet — This application is a desktop network traffic analyzer that provides real-time monitoring and forensic inspection of… fujiapple852/trippy — Trippy is a network diagnostic tool and terminal user interface that combines ping and traceroute functionality to…