Domains

Domains groups traffic by hostname so you can start from names instead of 5‑tuples.

• Shows per-domain rollups (connections/bytes + query/response/failure-style counters).
• The details pane shows “IP hints”. When DNS answers aren’t visible (DoH/DoT/caching), it can still show Observed IPs (from flows) using TLS SNI / HTTP Host hints.

How to use it:

• Select a domain and press Enter to drill into the relevant Flows.
• Press s to change the sort mode.
• Press c to clear an active subset filter.

What's weird?

What’s weird? is a curated set of detectors meant to answer “what looks broken/slow?” without needing deep Wireshark knowledge.

• Each detector includes a short “why it matters”.
• Pressing Enter on a detector filters down to the affected flows so you can drill into packets/streams.

How to use it:

• Select a detector (you can also press 1–9 to jump-select) and press Enter.
• Press c to clear an active subset filter.

Expand

Expand / Explain (?) gives plain-English context for what you’re looking at.

• From Flows, press Enter to open Packets, then press ? to open Explain.
• Explain is best-effort: it tries to classify the flow and show “why I think that” + “next steps”.

Tip: press h for help and g for glossary.

Quickstart

Download a release (recommended)

Grab a binary from GitHub Releases:

• https://github.com/vignesh07/babyshark/releases

Or build from source

Features

• Offline: open .pcap / .pcapng and browse:
  • flows list → packets list → follow stream
  • stream search with highlighting + n / N navigation
• Live: capture and inspect traffic in the TUI:
  • list capture interfaces
  • live capture with optional display filter
  • optional write-to-file while capturing
• Per-flow analysis:
  • Health badges — colored dot (green/yellow/red) on each flow based on RST, incomplete handshakes, retransmissions
  • Asymmetry labels — DL/UL suffix in flow list + download-heavy/upload-heavy/balanced in details (falls back to A>B/B>A when local side is ambiguous)
  • TCP timing — handshake RTT, server think time, data transfer duration in the details pane
  • TLS version display — shows negotiated version from ServerHello when visible, flags deprecated versions (<= TLS 1.1)
• Weird detectors:
  • TCP resets, handshake-not-completed, DNS failures, retransmit/OOO hints, high-latency flows
  • Deprecated TLS — flags flows using TLS 1.0 or 1.1
  • Chatty hosts — flags ≥10 flows to the same destination within 60 seconds
• Timeline view (T):
  • Gantt — phase-colored horizontal bars (handshake / TLS / data / close) with hostname labels
  • Scatter — per-packet direction/retransmit dot plot
  • Color legends, pattern callouts, and plain-English narrative in details
• Notes/export:
  • bookmark flows
  • export markdown report (latest + timestamped copies)

Install

Option A: GitHub Release (recommended)

Download a prebuilt binary:

• https://github.com/vignesh07/babyshark/releases

Option B: build from source

Prereqs:

• Rust toolchain (stable)
• (Live mode only) tshark

Option C: cargo install (dev-friendly)

Install tshark (required for --live)

tshark is the official Wireshark CLI.

macOS

Linux

Debian/Ubuntu:

Fedora:

Arch:

Verify:

Permissions note: live capture may require elevated permissions (sudo, dumpcap caps, or being in the wireshark group). If babyshark prints a permission error, follow the guidance it outputs.

Troubleshooting

babyshark updated in git but my command still runs old behavior

If you installed with cargo install, you need to reinstall after pulling:

Live capture fails (permissions)

Try running with sudo:

If that works, you likely need to configure capture permissions (dumpcap, wireshark group, etc.) on your OS.

Domains shows ips=0 for everything

This often happens when DNS answers aren’t visible (DoH/DoT or cached). Babyshark will still show Observed IPs (from flows) using TLS SNI / HTTP Host hints when available.

Usage

Offline PCAP

List live interfaces

Live capture

Live capture with Wireshark display filter

Live capture and write to file

Example screens (sanitized)

These are text-only examples of what you’ll see in the TUI. IPs/domains are anonymized.

Overview (live)

Domains

Weird stuff

Timeline

Timeline is the visual story of your capture. It shows when each connection started, what phases it went through (handshake, TLS, data transfer, close), and how they overlap.

• Gantt — horizontal bars colored by TCP phase, with hostname labels
• Scatter — per-packet dots colored by direction (you→server, server→you, retransmit)
• Patterns — automatic callouts for simultaneous opens, DNS→TLS hostname/time correlations, retransmission warnings
• Narrative — plain-English "What happened" in the details panel (uses upload/download wording only when local side is inferable)

Flows

Keybindings (TUI)

Top-level:

• o overview
• D domains
• W weird stuff
• F flows
• T timeline (Gantt + Scatter)
• h help
• g glossary
• q quit

In views:

• Enter drill down (domains/weird → flows, flows → packets)
• Esc back
• c clear active subset filter
• ? explain selected flow
• x dismiss onboarding hint (Overview)

Flows view:

• ↑/↓ or j/k move
• / filter
• t / u toggle TCP / UDP
• b bookmark flow
• E export report

Timeline view:

• Tab / Shift-Tab switch Gantt / Scatter
• ↑/↓ or j/k move
• PgUp/PgDn page
• Enter drill into Packets

Packets view:

• f follow stream

Stream view:

• / search
• n / N next / prev match
• Tab / Shift-Tab cycle stream direction
• ↑/↓ scroll

Output files

When you bookmark/export, babyshark writes next to the PCAP in a hidden directory:

• .babyshark/case.json — bookmarks
• .babyshark/report.md — latest report (overwritten)
• .babyshark/report-YYYYMMDD-HHMMSS.md — versioned reports

Roadmap

• Prettier onboarding + docs (screenshots/gifs)
• --bpf capture filter pass-through for live mode
• Even better protocol hints + flow classification
• Improved TCP reassembly (gap/retransmit markers)
• Packaging improvements (TBD)

License

MIT © 2026 Vignesh Natarajan