How to Install and Use Termshark in Linux for Terminal Network Packet Analysis

Network troubleshooting and security analysis often rely on Wireshark, the industry-standard packet inspection utility. However, running Wireshark on headless Linux servers, remote cloud instances, or minimal distributions without a desktop environment is traditionally limited to raw command-line output from tshark or tcpdump. termshark bridges this gap by delivering an interactive, Wireshark-inspired terminal user interface (TUI) powered by tshark.

With familiar multi-pane views displaying the packet list, detailed protocol hierarchy, and raw hex dump, termshark enables system administrators and network engineers to dissect live network traffic and analyse PCAP capture files directly over SSH.

Prerequisites and Dependency Installation

termshark relies on tshark (the terminal backend of Wireshark) to decode network packets. Before installing termshark, ensure tshark is available on your Linux distribution:

Debian / Ubuntu

sudo apt update
sudo apt install -y tshark

During installation, Debian and Ubuntu prompt whether non-superusers should be permitted to capture packets. Choose Yes, then add your user account to the wireshark system group:

sudo usermod -aG wireshark $USER

Log out and log back in for group permissions to take effect without requiring sudo for every capture session.

RHEL / Fedora / AlmaLinux

sudo dnf install -y wireshark-cli

Arch Linux

sudo pacman -S wireshark-cli

Installing termshark on Linux

termshark is distributed as a single static binary written in Go.

Method 1: Direct Binary Download (Recommended)

Download the latest release binary matching your system architecture:

# Download pre-built archive
curl -s https://api.github.com/repos/gcla/termshark/releases/latest \
  | grep "browser_download_url.*linux_x64.tar.gz" \
  | cut -d : -f 2,3 \
  | tr -d \" \
  | wget -qi -

# Extract and move to PATH
tar -zxvf termshark_*_linux_x64.tar.gz
sudo mv termshark_*_linux_x64/termshark /usr/local/bin/
rm -rf termshark_*_linux_x64*

Method 2: Using Go

If Go 1.18+ is installed on your workstation:

go install github.com/gcla/termshark/v2/cmd/termshark@latest

Confirm the installation by verifying the binary version:

termshark --version

Navigating the termshark Interface

The termshark interface mirrors the classic Wireshark tripartite layout:

• Packet List (Top Pane): Displays a chronological stream of captured packets, listing packet number, timestamp, source IP, destination IP, protocol, and summary info.
• Packet Structure (Middle Pane): Provides a collapsible tree structure detailing headers across OSI layers (Ethernet, IPv4/IPv6, TCP/UDP, Application data).
• Packet Hex Dump (Bottom Pane): Renders raw packet bytes side-by-side in hexadecimal and ASCII representations.

Essential Navigation Shortcuts

• Tab: Cycle focus between the Display Filter bar and the three packet inspection panes.
• Up / Down Arrows or j / k: Scroll through packets or navigate header fields.
• Enter: Expand or collapse protocol structures in the middle pane.
• /: Focus the Wireshark display filter bar at the top of the screen.
• q: Exit termshark.

Capturing Live Network Traffic

To capture packets directly from a network interface, use the -i flag followed by the interface name (such as eth0 or wlan0):

termshark -i eth0

To inspect available network interfaces before launching:

termshark -D

Analysing Saved PCAP Files

termshark is an ideal tool for incident triage when analysing capture files recorded on remote servers:

termshark -r /var/log/network-traffic.pcap

All protocol decoding and display filtering operate identically on saved files as they do on live interfaces.

Applying Wireshark Display Filters in termshark

termshark supports the full syntax of Wireshark display filters. Press / to jump to the filter bar at any time, type your filter query, and press Enter to apply it:

• Filter by protocol: dns or http or tls
• Filter by host IP: ip.addr == 192.168.1.100
• Filter TCP SYN packets: tcp.flags.syn == 1 and tcp.flags.ack == 0
• Filter by destination port: tcp.port == 443
• Filter failed HTTP responses: http.response.code >= 400

To clear an active filter, press /, delete the filter string, and press Enter.