termshark

Load a local PCAP into termshark or select an interface for a live capture, then use Wireshark display filters and packet or flow views. The terminal interface can inspect reconstructed TCP/UDP flows and protocol conversations, which is useful on a remote machine with a large capture. Packet ranges can be copied from the terminal. termshark is MIT-licensed, but it needs tshark installed at runtime and available on PATH; the README specifies version 1.10.2 or later. Live capture also depends on tshark’s capture permissions. The interface exposes only part of tshark’s capabilities, so confirm a specialized feature before choosing it for that task.