Termshark: Wireshark-style Packet Analysis Directly on the Linux Terminal – ITFROMZERO

Table of Contents

The Nightmare of Network Debugging via SSH

I once found myself in a frustrating situation. A company service cluster suddenly experienced intermittent connection issues at 2 AM. The team suspected a firewall misconfiguration or a TLS handshake problem.

At the time, I only had SSH access. The only tool available was tcpdump. However, the data streaming across the screen looked like a chaotic matrix of text. To inspect every layer from Ethernet to HTTP, I had to save a .pcap file, use scp to download it to my local machine, and then open it with Wireshark.

This process was incredibly time-consuming. Switching back and forth between the Terminal and a GUI caused me to lose focus. In “fire-fighting” situations, every minute spent waiting for a file download is precious.

Why tcpdump is Sometimes Not Enough

tcpdump is a legend, no doubt about it. But when you need to dig deep into packet content, it reveals several weaknesses that can frustrate engineers:

Visual Clutter: The flat text format makes it difficult to distinguish protocol headers.
Lack of Flexibility: You cannot use arrow keys to scroll and quickly inspect individual packets.
Difficult Stream Tracking: Following a TCP stream in tcpdump is a real challenge unless you’ve memorized complex filters.

Many people opt for X11 Forwarding to push the Wireshark interface to their local machine. However, if the ping exceeds 100ms, the interface becomes so laggy it’s unusable.

Three Common Approaches Today

For network analysis in a Command Line Interface (CLI) environment, we usually have three options:

Traditional: Export .pcap files using tcpdump and download them. This is slow and cumbersome.
Using TShark: The CLI version of Wireshark. It’s powerful, but the display is still quite dry.
Using Termshark: This is the optimal solution I want to introduce.

Termshark: A Pocket-Sized Wireshark Interface

Termshark is a Terminal UI (TUI) for tshark, written in Go. It perfectly recreates Wireshark’s classic three-pane layout: Packet list, layer details, and Hex data. This tool runs smoothly via SSH, requires no GUI, and consumes very few system resources.

Quick Installation on Linux

If you already have a Go environment set up, installation takes only a few seconds:

go install github.com/gcla/termshark/v2/cmd/termshark@latest

Or download the pre-built binary directly from GitHub to use immediately:

curl -LO https://github.com/gcla/termshark/releases/download/v2.4.0/termshark_2.4.0_linux_x64.tar.gz
tar -zxvf termshark_2.4.0_linux_x64.tar.gz
sudo mv termshark_2.4.0_linux_x64/termshark /usr/local/bin/

Important Note: Don’t forget to install tshark first, as it is the core engine underneath:

sudo apt update && sudo apt install -y tshark

Real-world Applications

I typically use Termshark in the following two scenarios.

1. Live Packet Capture in Real-time

To check traffic on the eth0 network interface, simply type:

sudo termshark -i eth0

The interface will appear immediately. Use the Tab key to switch between panes and press / to apply filters. For example, enter http.request.method == "POST" to find requests sending data to the server.

2. Inspecting Existing pcap Log Files

When I receive a log file from a colleague, I usually check it on the spot instead of downloading it:

termshark -r debug_capture.pcap

Essential Shortcuts to Remember

To operate like a pro-user, you should memorize these keys:

Tab: Move back and forth between the 3 panes.
Enter: Expand or collapse packet layer details.
/: Activate the filter search bar (syntax is identical to Wireshark).
f: Follow stream feature, extremely useful for viewing the entire client-server exchange.
q: Quickly exit the program.

Field Experience: The MTU Problem

I once handled a tricky case involving an MTU (Maximum Transmission Unit) error. Packets were being fragmented and dropped at an intermediate hop. Thanks to Termshark, I quickly filtered for icmp and inspected the Don't Fragment flag in the IP header directly on the gateway server.

Using the old method, it would have taken me at least 15 minutes to download and analyze the file. With Termshark, everything was resolved in less than 3 minutes. This tool is extremely lightweight, consuming only a few dozen MBs of RAM, a far cry from the hundreds of MBs required by the GUI version of Wireshark.

Conclusion

Termshark doesn’t completely replace Wireshark, especially when you need to generate complex graphs. However, for quick debugging and on-site troubleshooting, it is an unbeatable tool. Try installing it on your Jump Host or Staging Server. You’ll soon love the feeling of performing network analysis with just your keyboard, no mouse required.