Termshark – A terminal UI for tshark, inspired by Wireshark

Re:Termshark – A terminal UI for tshark, inspired by Wireshark by imglorp on Tuesday December 05, 2023 @01:07PM (#38534645)

The other way to do it is ssh to remote box, `tcpdump -w foo.pcap` there, then bring it back by scp and you can open it for analysis in full wireshark.

[ Parent | on HN ]

Re:Termshark – A terminal UI for tshark, inspired by Wireshark by gorgonq on Tuesday December 05, 2023 @02:10PM (#38535512)

You can even let tcpdump write packets to stdout, then pipe directly to your local wireshark and get a live view:

    ssh your-host tcpdump -w - -U 'not port 22' | wireshark -i - -k

makes sense to exclude port 22 from the dump =)

[ Parent | on HN ]

Re:Termshark – A terminal UI for tshark, inspired by Wireshark by silentprog on Tuesday December 05, 2023 @03:44PM (#38536664)

This works, but you won’t get the interface name in wireshark. If you also require the captured interface you can substitute tcpdump with tshark

[ Parent | on HN ]

Re:Termshark – A terminal UI for tshark, inspired by Wireshark by ElijahLynn on Tuesday December 05, 2023 @07:11PM (#38538781)

I've used this method with success! +1

[ Parent | on HN ]

Re:Termshark – A terminal UI for tshark, inspired by Wireshark by emmelaich on Tuesday December 05, 2023 @07:07PM (#38538747)

tshark includes the functionality of tcpdump and more

[ Parent | on HN ]