Inspect Packets With termshark

Capture and analyze traffic in a terminal interface backed by tshark.

macOSnetworkmonitoringtcpdumpLow risk

Run termshark -i en0 to capture on an interface; press ? for help and q to quit.

01Command

Command

$ termshark -i en0

02What it does

termshark wraps tshark in a Wireshark-like read-only UI with packet list, detail and hex panes, plus display filters like tcp.port == 443. It can also open an existing pcap file instead of capturing live.

03Risk

RiskLow risk

CompatibilitymacOS with Homebrew installed

!Warning: Capturing needs elevated privileges and may record sensitive payloads; only capture networks you are authorized to inspect.

04Undo

✓No undo needed — this command does not change persistent state.

05Sources

Homebrew formula: termshark
Homebrew · vendor-doc · 2026-09-20
Evidence: Packages termshark, a terminal UI for tshark packet captures.

Last verified: 2026-09-22 · Category: Network