9 ms·
Termshark – A terminal UI for tshark, inspired by Wireshark
- macinjosh 8y agoI was looking for something like this just yesterday! Looking forward to giving it a try.
- psophis 8y agoThis is very cool. Though I’ve always done remote wireshark captures: ssh root@sniff_server_ip -p port tcpdump -U -s0 'not port 22' -i eth0 -w - | wireshark -k -i - Source: https://serverfault.com/questions/362529/how-can-i-sniff-the-traffic-of-remote-machine-with-wireshark#530020 https://serverfault.com/questions/362529/how-can-i-sniff-the... It works very well on low volume captures.
- kevintb 8y agoah, very handy!
- neilv 8y agoThis method even worked for Wiresharking all PS3 traffic in real time for a GTA Online session, running the tcpdump on a little plastic old mipsel SoC OpenWrt router that was also doing all the routing (not a passive sniffing box), without noticeable effect on gameplay. (I was trying to detect cheaters.) BTW, for anyone new to tcpdump, you can also specify selectors/filtering on the command line, to reduce the traffic. The filtering in Wireshark is on top of that.
- deleted 8y ago[deleted]
- kayoone 8y agoonline games are pretty low volume though, data is usually transmitted at a few Kbps per player. Just out of interest, how did you try to spot cheaters doing that?
- kodisha 8y agoNot quite in their interest to publicly explain methods of how they detect cheaters :) It's one of best guarded secrets in gaming industry.
- kayoone 8y agoOP does not sound like he was actually working for Rockstar on GTA, more like a hobby project
- neilv 8y agoCorrect, not working for Rockstar. And I'm pretty sure R* stopped caring about cheaters ruining Online for last-gen console, shortly after that could push people to buy the game again, for current-gen. :)
- stjohnswarts 8y agoWouldn't they just cheat with some of the common methods and train some AI with the packet dumps to spot it?
- Something1234 8y agoPerhaps he was looking for an abnormal amount of traffic, attempting to resend the same message, and hoping the server will do it multiple times in the same frame. I would guess trying to find spots where the client is overly trusted.
- gsich 8y agoGame traffic is usually encrypted. How good depends on the game. So you might only see some packets with a larger payload and deduce stuff from there.
- iammeow 8y agoCame here to write the very same command. I only use -l instead of -U. In Windows using WSL I use something like this: ssh root@remotehost "tcpdump -i eth1 -s0 -l -w - 'udp'" | /mnt/c/Program\ Files/Wireshark/Wireshark.exe -k -i -
- kees99 8y agoOption "-l" only supposed to be used with text output. When mis-applied to binary (-w) output, it will: - On Linux, flush buffer at wrong places, breaking last (few) packet(s); - On Windows, flush buffer after every byte (which gives acceptable result, but is very inefficient). With "-w", always use "-U" instead.
- turrini 8y agoI've made a simple script based on your example: wirelive.sh: #!/bin/bash if [[ -z "$1" ]]; then echo -e "Usage: $(basename $0) <host[:port]> <interface> [filters]" exit fi ssh_host=$(echo $1 | cut -d: -f1) ssh_port=$(echo $1 | cut -s -d: -f2) [[ -z "$ssh_port" ]] && ssh_port=22 [[ -z "$2" ]] && tcpdump_interface="any" || tcpdump_interface="$2" [[ ! -z "$3" ]] && tcpdump_filters="and \($3\)" ssh root@${ssh_host} -p ${ssh_port} \ tcpdump -U -s0 "not port ${ssh_port} ${tcpdump_filters}" -i ${tcpdump_interface} -w - \ | wireshark -k -i -
- pstuart 8y agonice, but a small nit: you don't need to quote variables inside bash double brackets.
- ssebastianj 8y agoIndeed, this method is cool. It allowed me to sniff the traffic between some poorly documented IoT device and a remote server (unencrypted, what else) via OpenWrt: [0] https://openwrt.org/docs/guide-user/firewall/misc/tcpdump_wireshark https://openwrt.org/docs/guide-user/firewall/misc/tcpdump_wi...
- ohples 8y agoHmm, XForwarding Wireshark is one of the only reasons I use XForwarding, I should see what this can do.
- astatine 8y agoLooks very good! Will give it a spin soon.
- fulafel 8y agoThis seems useful. Are there other good recent tools for analyzing network traffic? For example something more high-level than Wireshark? A common use is to zero in on the flow you're interested in, and see which party is saying what. And maybe zoom back out and pick another flow. The flow choosing part could use better UI, maybe in the form of a more high level view.
- nitrogen 8y agoI seem to remember a really old gtk1.x app that would show network flows as blobs representing local/remote hosts on the left and right of the screen, and ribbons connecting the blobs scaled to the amount of traffic per stream. Don't remember the name though.
- Macuyiko 8y agoEtherApe? https://etherape.sourceforge.io https://etherape.sourceforge.io I remember using that as well many years ago. Fun times.
- zamber 8y ago> Overview of changes in EtherApe 0.9.18 (Sunday, June 3, 2018): > EtherApe now is a pure GTK 3 application, with canvas supplied by GooCanvas. It's still in active development! Will have some fun with it :).
- Macuyiko 8y agoI need to admit, I have a lot of respect for someone that can keep a project going for so long. I assume there are contributors, but it wouldn't surprise me if it's a one-person lead. People who also tend to have other side projects going. I have trouble maintaining a bunch of GitHub side repo's and keeping Ubuntu installations on a bunch of VPS's up to date.
- xuhu 8y agoThere was some discussion about opening a new wireshark window at the current location so you could navigate like in a browser more or less. It didn't go anywhere https://seclists.org/wireshark/2015/Apr/97 https://seclists.org/wireshark/2015/Apr/97
- neilv 8y agoDrat; this was my best idea for a portfolio Rust app! The more we do of this kind of tool in a memory-safe language, the better. For a while, it seemed like Wireshark dissectors were second only to 2D image format libraries, for memory exploits. I joked that one way to locate and compromise a network admin's workstation would be to create a simple network anomaly that would prompt them to fire up Wireshark. :)
- vbernat 8y agoIt's an UI for tshark. The dissectors are from Wireshark.
- ausjke 8y agoisn't this a go application, I did not see any rust usage yet here.
- smolder 8y agoWhile GP wanted to write it in rust, I think they just meant it's not as useful of a thing to write (in any language) now that this implementation exists.
- cjcampbell 8y agoI have some students who are really going to dig this. I teach an introductory networking course with students that have significantly less technical background than the typical CS networks course. A lot of the students are already feeling stretched, as this is their first deep dive into the terminal. Though I do teach them how to run a remote capture through SSH, I can imagine them finding some relief in this.
- nextlevelwizard 8y agoDoesn't have vim bindings :( But handles custom rules well :)
- programd 8y agoAnother vote for Vim key bindings. Think of it as future proofing. For all eternity :)
- antpls 8y agoI wish softwares were more often retrofitted to terminal when possible. Good work !
- derpherpsson 8y agoThe terminal is Eternal. It has not changed since the Dawn of Time. It's not retrofitting. If you make it work for the terminal it will always work from now on. It comes outside the reaches from the graphical designers. Nothing with a graphical design survives more than 10 years.
- gumby 8y agoThe MVC approach seems to have been abandoned. I typically write my code as a library that can then be called by an interface (or other program) rather than as a monolithic unit. Also makes it easier to run on diferent devices.
- moshohayeb 8y agoThis is incredibly useful. I spend a lot of time rsyncing captures to examine on WireShark. This went immediately to my personal /bin/
- deleted 8y ago[deleted]
- lloeki 8y agoWireshark is very good and this definitely looks like a nice tool, that could be a good alternative to ngrep that I usually rely on on the command line. https://github.com/jpr5/ngrep https://github.com/jpr5/ngrep
- koffiezet 8y agoLooks very nice, but not yet available in brew on OSX?
- felipelemos 8y agoReally nice. Reminds me of IPTraf.
- dordoka 8y agoLink to the project in github [0], as the site seems to be down due to the hug of death. [0] https://github.com/gcla/termshark https://github.com/gcla/termshark
- mikehollinger 8y agoThat looks good! Good job.
- ausjke 8y agoawesome tool, termshark is 16MB after compiling and it is so handy and useful especially for servers. Using it right now.
- knowsmorsecode 8y agoPost your python to go urwid port gcla. Well done!
- rosstex 8y agoAwesome work! Let's get it into Homebrew.
- gcla 8y agoThanks to everyone for the kind words and encouragement. It's been very gratifying. Now I have a good number of suggestions, and a handful of bugs to fix!
- CodeWriter23 8y agoMade me a little nostalgic for our old Sniffer™️. Edit: from Network General.
- knolax 8y agoDoes it require ncurses?