Problem

termshark does not support extcap interfaces

Interface list

$ tshark -D
1. en0 (Wi-Fi)
2. p2p0
3. awdl0
4. bridge0 (Thunderbolt Bridge)
5. utun0
6. en1 (Thunderbolt 1)
7. en2 (Thunderbolt 2)
8. lo0 (Loopback)
9. gif0
10. stf0
11. XHC20
12. ciscodump (Cisco remote capture)
13. randpkt (Random packet generator)
14. sshdump (SSH remote capture)
15. udpdump (UDP Listener remote capture)

Current Behavior

termshark errors as if there is a sudo error when a randpkt interface is sent in:

$ sudo termshark -i randpkt
(The termshark UI will start when packets are detected...)
Cannot capture on device randptk: exit status 1 (exit code 1)
See https://termshark.io/no-root for more info.

$ sudo termshark -i 13
(The termshark UI will start when packets are detected...)
Cannot capture on device randpkt: exit status 1 (exit code 1)
See https://termshark.io/no-root for more info.

Expected Behavior

termshark to support randpkt interface

Comparisons to what tshark does

$ tshark -i randpkt -c 5
Capturing on 'Random packet generator: randpkt'
    1   0.000000 208.21.2.184 → 10.1.1.99    DNS  916 Unknown operation (6) response 0x3088 Unknown error (14)[Malformed Packet] ff:ff:ff:ff:ff:ff ← 01:01:01:01:01:01
    2   1.000000 208.21.2.184 → 10.1.1.99    DNS  3583 Unknown operation (11) response 0x300d Name exists[Malformed Packet] ff:ff:ff:ff:ff:ff ← 01:01:01:01:01:01
    3   2.000000 208.21.2.184 → 10.1.1.99    DNS  3116 Unknown operation (7) response 0x3000 Refused[Malformed Packet] ff:ff:ff:ff:ff:ff ← 01:01:01:01:01:01
    4   3.000000 208.21.2.184 → 10.1.1.99    DNS  2365 Unknown operation (15) response 0x3060 Unknown error (13)[Malformed Packet] ff:ff:ff:ff:ff:ff ← 01:01:01:01:01:01
    5   4.000000 208.21.2.184 → 10.1.1.99    DNS  2803 Zone change notification response 0x30d6 RRset does not exist[Malformed Packet] ff:ff:ff:ff:ff:ff ← 01:01:01:01:01:01
5 packets capture
$ 

Context

# version info
$ termshark -vv
termshark v2.0.2++
using tshark 3.0.7 (from /Applications/Wireshark.app/Contents/MacOS/tshark)

Found when trying to test multiple network interfaces, #75.

Marking as both bug and feature request because it's technically another feature, but expectation is that all interfaces that work with tshark will work with termshark.

MacOS 10.14; amd64.

Update (per discussion)

Feature request here is to default to dumpcap (current behavior), but if an interface is not recognized:

1. Check tshark for virtual interfaces (both numbered and extcap by name)
2. If tshark has that interface, change packet reader to tshark and read that interface
3. If not, error for unrecognized interface as usual

Prerequisites

Please verify these before submitting an issue.

• [x] I am running the latest versions of Termshark and Wireshark.
• [x] I checked the README and User Guide and found no answer
• [x] I searched issues and this has not yet been filed

Problem

termshark 2.2.x window is not visible termshark 2.0.3 is ok

Current Behavior

After startup termshark window is not visible termshark is clearly running, I can exit by pressing Q + Enter

Expected Behavior

termshark window must be visible

Please describe the behavior you are expecting.

Screenshots as applicable

Steps to Reproduce

1.Connect from Windows to Linux(tested on Ubuntu 20.04 and Centos 7.5) using Putty or any ssh client 2. Start termshark for example termshark -r test.pcap 3. Some loading percents(in right top corner) are visible in the beginning for 2 seconds, after that only black screen is seen.

Context

Good one:

termshark -v

termshark v2.0.3

termshark -v | cat

TShark 1.10.14 (Git Rev Unknown from unknown)

Copyright 1998-2015 Gerald Combs [email protected] and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.56.1, with libpcap, with libz 1.2.7, with POSIX capabilities (Linux), without libnl, with SMI 0.4.8, with c-ares 1.10.0, with Lua 5.1, without Python, with GnuTLS 3.3.29, with Gcrypt 1.5.3, with MIT Kerberos, without GeoIP.

Running on Linux 3.10.0-862.9.1.el7.x86_64, with locale en_US.UTF-8, with libpcap version 1.5.3, with libz 1.2.7. Intel Xeon E3-12xx v2 (Ivy Bridge, IBRS)

Built using gcc 4.8.5 20150623 (Red Hat 4.8.5-44).

Bad one:

termshark -v

termshark v2.2.0

termshark -v | cat

TShark 1.10.14 (Git Rev Unknown from unknown)

Copyright 1998-2015 Gerald Combs [email protected] and contributors. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with GLib 2.56.1, with libpcap, with libz 1.2.7, with POSIX capabilities (Linux), without libnl, with SMI 0.4.8, with c-ares 1.10.0, with Lua 5.1, without Python, with GnuTLS 3.3.29, with Gcrypt 1.5.3, with MIT Kerberos, without GeoIP.

Running on Linux 3.10.0-862.9.1.el7.x86_64, with locale en_US.UTF-8, with libpcap version 1.5.3, with libz 1.2.7. Intel Xeon E3-12xx v2 (Ivy Bridge, IBRS)

Built using gcc 4.8.5 20150623 (Red Hat 4.8.5-44).

Strace logs attached:

strace_bad.log strace_good.log

I started testing out the termshark to hopefully one day be able to use it more often with packet capture analysis. I discovered that termshark is consistently utilizing a lot of CPU resources, causes my system to hang, and will frequently output the error codes shown in the screenshots.

$ tshark -v TShark (Wireshark) 3.0.3 (Git commit 6130b92b0ec6)

Copyright 1998-2019 Gerald Combs [email protected] and contributors. License GPLv2+: GNU GPL version 2 or later http://www.gnu.org/licenses/old-licenses/gpl-2.0.html This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3, with GLib 2.58.3, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.13.0, with Lua 5.1.5, with GnuTLS 3.6.7 and PKCS #11 support, with Gcrypt 1.8.4, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.34.0, without LZ4, without Snappy, without libxml2.

Running on Linux 5.2.11-100.fc29.x86_64, with Intel(R) Core(TM) i7-8650U CPU @ 1.90GHz (with SSE4.2), with 15687 MB of physical memory, with locale en_US.UTF-8, with libpcap version 1.9.0-PRE-GIT (with TPACKET_V3), with GnuTLS 3.6.7, with Gcrypt 1.8.4, with zlib 1.2.11, binary plugins supported (0 loaded).

Built using gcc 8.3.1 20190223 (Red Hat 8.3.1-2).

Is your feature request related to a problem? Please describe.

The dark mode's background is pure dark, my all TUI Apps and terminal background is #202326. Maybe this feature is a personal aesthetic issue, but the most TUI Apps can customize the theme or obey base16 that make the theme of App and terminal look more matching.

Describe the solution you'd like

If the workload of the custom theme is heavy, base16 is a better choice.

I started trying to use termshark to analyze packet captures for my work. I noticed that I am unable to change the scrollbar position by clicking on the scrollbar itself. The scrollbar only seems to function by clicking either the box on the bar or by clicking on the arrows. I'm referring to being able to click on a different position on the scrollbar in order to jump to that position, i.e. jump quickly to the end of the file. I'm using Tilix terminal, Fedora 29, xorg session (in case this information is helpful).

% termshark Error: terminal entry not found [TERM: screen.xterm-256color] zsh: exit 1 termshark % TERM=xterm-256color termshark Packets read from interface eth0 have been saved in /$home/.cache/termshark/eth0-921608986.pcap

I've published termshark on the Snap store so it can be easily installed on almost all major distros just by issuing: snap install termshark
After installation, it requires some additional permissions:

snap connect termshark:network-control
snap connect termshark:bluetooth-control
snap connect termshark:firewall-control
snap connect termshark:ppp
snap connect termshark:raw-usb
snap connect termshark:removable-media

Could you please add the feature to read from stdin to support something like this:

kubectl -n NS exec POD -c CONTAINER -- tcpdump -s0 -w - -lUni INTERFACE | termshark -i -

or this:

ssh USER@IP -- tcpdump -s0 -w - -lUni any port PORT or port PORT | termshark -i -

I'm on 2.2.0 . Sometimes I can't quit. The confirmation dialog comes up but nothing happens when I click or hit enter on the ok button. The cancel button works fine.

ps aux | grep tshark lists no tshark processes but the "waiting for packets" animation thing is still going.

I don't know how to repro this.

https://www.youtube.com/watch?v=7cbjlV1l28U

• I am running the latest versions of Termshark v2.1.1 and Wireshark.
• I checked the README and User Guide and found no answer
• I searched issues and this has not yet been filed

Problem

Launching Termshark from directory of Wireshark (x64) like:

F:\internet\sniffer\WireShark-3.2\>  start cmd.exe /c termshark_2.1.1_windows_x64\termshark.exe

Causes the capture to stop after 1 packet with this error!

Since a dumpcap -D lists:

1. \\.\airpcap00 (AirPcap USB wireless capture adapter nr. 00)
2. \Device\NPF_{3A46ACA0-CBED-44BC-A239-6AEA3D0C451D} (Ethernet)
3. \Device\NPF_{7B640089-F33E-4886-823D-87966FA4616F} (Bluetooth-nettverkstilkobling 3)
4. \Device\NPF_{F92984E3-5D40-4AD9-B054-41288EAE699F} (Wi-Fi 2)

I assume \\.\airpcap00 was selected when an adapter wasn't specified.

I'm not sure the above error was a once-in-a-blue-moon event. Termshark works brilliant for the most part (although slow for WiFi-traffic like the above). The dark-mode is also way cool!

And the reason I have to use start cmd.exe /c, is because my shell (4NT.exe) gets killed! during Termshark's run. I use ProcessExplorer and see the parent process vanished while termshark.exe was running.

Highly strange and maybe another issue for later.

I'm on Win-10 (x64).

EDIT: I stumbled upon the C:\Users\Gisle\AppData\Local\termshark\termshark.log with this:

...
time="2020-08-01T12:36:06+02:00" level=info msg="Scheduler requested interface/fifo load for 'AirPcap USB wireless capture adapter nr. 00'"
time="2020-08-01T12:36:06+02:00" level=info msg="Initialized stream widget cache with 100 entries."
time="2020-08-01T12:36:06+02:00" level=info msg="Starting new interface/fifo load 'AirPcap USB wireless capture adapter nr. 00'"
time="2020-08-01T12:36:06+02:00" level=info msg="Starting Iface command: dumpcap.exe [dumpcap -i AirPcap USB wireless capture adapter nr. 00 -w c:\\Users\\Gisle\\AppData\\Local\\termshark\\pcaps\\AirPcap_USB_wireless_capture_adapter_nr._00--2020-08-01--12-36-04.pcap]"
time="2020-08-01T12:36:06+02:00" level=info msg="Read cached tshark fields."
time="2020-08-01T12:36:06+02:00" level=info msg="Started PSML command tshark.exe [tshark -T psml -o gui.column.format:\"No.\",\"%m\",\"Time\",\"%t\",\"Source\",\"%s\",\"Destination\",\"%d\",\"Protocol\",\"%p\",\"Length\",\"%L\",\"Info\",\"%i\" -i - -l --color] with pid 2700"
time="2020-08-01T12:36:06+02:00" level=info msg="Capturing on 'AirPcap USB wireless capture adapter nr. 00'"
time="2020-08-01T12:36:06+02:00" level=info msg="Pcap file c:\\Users\\Gisle\\AppData\\Local\\termshark\\pcaps\\AirPcap_USB_wireless_capture_adapter_nr._00--2020-08-01--12-36-04.pcap has appeared - launching UI"
time="2020-08-01T12:36:06+02:00" level=info msg="Starting Tail command: termshark_2.1.1_windows_x64\\termshark.exe [termshark_2.1.1_windows_x64\\termshark.exe --tail c:\\Users\\Gisle\\AppData\\Local\\termshark\\pcaps\\AirPcap_USB_wireless_capture_adapter_nr._00--2020-08-01--12-36-04.pcap]"
time="2020-08-01T12:36:06+02:00" level=info msg="Launching termshark UI"
time="2020-08-01T12:36:06+02:00" level=info msg="File: c:\\Users\\Gisle\\AppData\\Local\\termshark\\pcaps\\AirPcap_USB_wireless_capture_adapter_nr._00--2020-08-01--12-36-04.pcap"
time="2020-08-01T12:36:06+02:00" level=info msg="Terminal was resized" event="&{{13817447476629760492 3363779901 0x133e6a0} 120 48}"
time="2020-08-01T12:36:07+02:00" level=info msg="Capturing on '-'"
time="2020-08-01T12:36:07+02:00" level=info msg="1 packet captured"

time="2020-08-01T12:36:07+02:00" level=info msg="Did not kill psml process: TerminateProcess: Ingen tilgang."
                                                                                             ^ "No Access"
time="2020-08-01T12:36:08+02:00" level=error msg="Error running command [command: dumpcap.exe [dumpcap -i AirPcap USB wireless capture adapter nr. 00 -w c:\\Users\\Gisle\\AppData\\Local\\termshark\\pcaps\\AirPcap_USB_wireless_capture_adapter_nr._00--2020-08-01--12-36-04.pcap], error: exit status 1]"

PS C:\WINDOWS\system32> termshark -i wifi Could not find network interface wifi

PS C:\WINDOWS\system32> tshark -i wifi Capturing on 'wifi' 1 0.000000 2600:100f:b01e:92c1:e497:adce:657c:53c1 → 2600:100f:b01e:92c1:6871:3be5:289d:c5f5 ICMPv6 86 Neighbor Solicitation for 2600:100f:b01e:92c1:6871:3be5:289d:c5f5 from 7e:50:49:23:f5:64 2 0.000250 2600:100f:b01e:92c1:6871:3be5:289d:c5f5 → 2600:100f:b01e:92c1:e497:adce:657c:53c1 ICMPv6 86 Neighbor Advertisement 2600:100f:b01e:92c1:6871:3be5:289d:c5f5 (sol, ovr) is at 20:79:18:8d:81:af 3 0.999516 0 40.90.10.180 → 172.20.10.3 TLSv1.2 85 31 Application Data 3 packets captured

Is your feature request related to a problem? Please describe.

Looking for documentation on how to perform upgrades of termshark.

Describe the solution you'd like

Share details on how to upgrade termshark. Example: Ubuntu repo only has 2.0.3-1. I want to upgrade to the latest. If the answer is "Remove 2.0.3 with apt, then git clone and compile from source" then so be it, but would like to see it in the documentation some where, because maybe there is an easier way.

EDIT: For myself, I accomplished an upgrade doing the following:

• sudo apt remove termshark --purge
• Make sure your golang version is up to date (at least 1.13).
• Install termshark via go packages for newest versions of go go install github.com/gcla/termshark/v2/cmd/[email protected]
• Fix any PATH problems.

Not sure if this is one size fits all process or if there are other recommendations.

Problem

Fails to launch with error

Current Behavior

Even after installing wireshark-common, tshark, and setting proper capabilities via setcap I still get the error: Could not enumerate network interfaces: exit status 2 upon trying to launch. I have also taken the usual steps with adding user to wireshark group

Expected Behavior

Termshark launches it's big, beautiful gui in the terminal

Context

Please provide the complete output of these commands: TShark (Wireshark) 2.6.10 (Git v2.6.10 packaged as 2.6.10-1~ubuntu18.04.0)

Copyright 1998-2019 Gerald Combs [email protected] and contributors. License GPLv2+: GNU GPL version 2 or later http://www.gnu.org/licenses/old-licenses/gpl-2.0.html This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Compiled (64-bit) with libpcap, with POSIX capabilities (Linux), with libnl 3, with GLib 2.56.4, with zlib 1.2.11, with SMI 0.4.8, with c-ares 1.14.0, with Lua 5.2.4, with GnuTLS 3.5.18, with Gcrypt 1.8.1, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.30.0, with LZ4, with Snappy, with libxml2 2.9.4.

Running on Linux 5.15.0-46-generic, with Intel(R) Core(TM) i3-6006U CPU @ 2.00GHz (with SSE4.2), with 7815 MB of physical memory, with locale C, with libpcap version 1.8.1, with GnuTLS 3.5.18, with Gcrypt 1.8.1, with zlib 1.2.11, binary plugins supported (0 loaded).

Built using gcc 7.4.0.

Please also provide any relevant information about your environment (OS, VM, pi,...)

Ubuntu 22.04

One of the first comments I received on termshark's initial release was did I consider using sharkd instead of tshark... I didn't, but out of ignorance! Sharkd is a daemon with a JSON interface that supports loading pcaps, checking filters, and various other tshark operations. It would have two main advantages:

• it would be faster for things like filter syntax checking because I wouldn't need to run a separate process each time
• it would be better for large pcaps because I wouldn't need the optimizations around loading pdml in chunks, reducing complexity a lot

The main disadvantages, afaict, are that

• sharkd isn't bundled on Windows.
• I can't see a way to get psml and pdml from it (but I must be missing that, surely)

Is your feature request related to a problem? Please describe.

use go-astilectron to beautify termshark gui

Describe the solution you'd like

use go-astilectron and uikit to beautify termshark

Describe alternatives you've considered

use go-astilectron to beautify termshark gui

Additional context

use go-astilectron to beautify termshark gui

Is your feature request related to a problem? Please describe.

Is there an official interface that supports developing termshark extension

Describe the solution you'd like

add http api to manipulate termshark,i recommend gin

Describe alternatives you've considered

add http api to manipulate termshark

Additional context

no