babyshark

Wireshark made easy (in your terminal).

Babyshark is a PCAP TUI that helps you answer:

• What’s using the network?
• What looks broken/weird?
• What should I select next?

Status: v0.3.0 (alpha).

• Offline .pcap / .pcapng viewing works without Wireshark
• Live capture requires tshark (Wireshark CLI)

Overview

Overview is the “start here” dashboard. It summarizes the capture and suggests what to do next.

• Shows quick totals (packets/flows), a traffic mix, and “top” tables (ports/hosts/flows).
• In live mode it shows capture status (pps + a last status/error line from tshark).

How to use it:

• Press D to jump to Domains (hostnames-first).
• Press W to jump to What’s weird? (curated detectors).
• Press F (or f) to jump to Flows (raw).
• Many rows are drill-down entry points: select a row and press Enter.

Domains

Domains groups traffic by hostname so you can start from names instead of 5‑tuples.

• Shows per-domain rollups (connections/bytes + query/response/failure-style counters).
• The details pane shows “IP hints”. When DNS answers aren’t visible (DoH/DoT/caching), it can still show Observed IPs (from flows) using TLS SNI / HTTP Host hints.

How to use it:

• Select a domain and press Enter to drill into the relevant Flows.
• Press s to change the sort mode.
• Press c to clear an active subset filter.

What's weird?

What’s weird? is a curated set of detectors meant to answer “what looks broken/slow?” without needing deep Wireshark knowledge.

• Each detector includes a short “why it matters”.
• Pressing Enter on a detector filters down to the affected flows so you can drill into packets/streams.

How to use it:

• Select a detector (you can also press 1–9 to jump-select) and press Enter.
• Press c to clear an active subset filter.

Expand

Expand / Explain (?) gives plain-English context for what you’re looking at.

• From Flows, press Enter to open Packets, then press ? to open Explain.
• Explain is best-effort: it tries to classify the flow and show “why I think that” + “next steps”.

Tip: press h for help and g for glossary.

---

Quickstart

Download a release (recommended)

Grab a binary from GitHub Releases:

• https://github.com/vignesh07/babyshark/releases

Or build from source

git clone https://github.com/vignesh07/babyshark
cd babyshark/rust
cargo install --path . --force
babyshark --help

---

Features

• Offline: open .pcap / .pcapng and browse:
  • flows list → packets list → follow stream
  • stream search with highlighting + n / N navigation
• Live: capture and inspect traffic in the TUI:
  • list capture interfaces
  • live capture with optional display filter
  • optional write-to-file while capturing
• Per-flow analysis:
  • Health badges — colored dot (green/yellow/red) on each flow based on RST, incomplete handshakes, retransmissions
  • Asymmetry labels — DL/UL suffix in flow list + download-heavy/upload-heavy/balanced in details (falls back to A>B/B>A when local side is ambiguous)
  • TCP timing — handshake RTT, server think time, data transfer duration in the details pane
  • TLS version display — shows negotiated version from ServerHello when visible, flags deprecated versions (<= TLS 1.1)
• Weird detectors:
  • TCP resets, handshake-not-completed, DNS failures, retransmit/OOO hints, high-latency flows
  • Deprecated TLS — flags flows using TLS 1.0 or 1.1
  • Chatty hosts — flags ≥10 flows to the same destination within 60 seconds
• Timeline view (T):
  • Gantt — phase-colored horizontal bars (handshake / TLS / data / close) with hostname labels
  • Scatter — per-packet direction/retransmit dot plot
  • Color legends, pattern callouts, and plain-English narrative in details
• Notes/export:
  • bookmark flows
  • export markdown report (latest + timestamped copies)

---

Install

Option A: GitHub Release (recommended)

Download a prebuilt binary:

• https://github.com/vignesh07/babyshark/releases

Option B: build from source

Prereqs:

• Rust toolchain (stable)
• (Live mode only) tshark

git clone https://github.com/vignesh07/babyshark
cd babyshark/rust
cargo install --path . --force
babyshark --help

Option C: cargo install (dev-friendly)

cargo install --git https://github.com/vignesh07/babyshark --bin babyshark

---

Install tshark (required for --live)

tshark is the official Wireshark CLI.

macOS

# macOS (Homebrew)
brew install wireshark

Linux

Debian/Ubuntu:

sudo apt-get update
sudo apt-get install -y tshark

Fedora:

sudo dnf install -y wireshark-cli

Arch:

sudo pacman -S wireshark-cli

Verify:

tshark --version
tshark -D

Permissions note: live capture may require elevated permissions (sudo, dumpcap caps, or being in the wireshark group). If babyshark prints a permission error, follow the guidance it outputs.

---

Troubleshooting

babyshark updated in git but my command still runs old behavior

If you installed with cargo install, you need to reinstall after pulling:

cd babyshark/rust
cargo install --path . --force

Live capture fails (permissions)

Try running with sudo:

sudo babyshark --live en0

If that works, you likely need to configure capture permissions (dumpcap, wireshark group, etc.) on your OS.

Domains shows ips=0 for everything

This often happens when DNS answers aren’t visible (DoH/DoT or cached). Babyshark will still show Observed IPs (from flows) using TLS SNI / HTTP Host hints when available.

---

Usage

Offline PCAP

babyshark --pcap ./capture.pcap

List live interfaces

babyshark --list-ifaces

Live capture

babyshark --live en0

Live capture with Wireshark display filter

babyshark --live en0 --dfilter "tcp.port==443"

Live capture and write to file

babyshark --live en0 --write-pcap /tmp/live.pcapng

---

Example screens (sanitized)

These are text-only examples of what you’ll see in the TUI. IPs/domains are anonymized.

Overview (live)

PCAP Viewer
babyshark   Overview  flows:114 packets:4227  tcp:on udp:on q=—

Overview  (D domains, W weird, F flows)
In plain English
Packets: 4227   Flows: 114   Top talker: 10.0.0.6 (2711.9KB)   Top talker (pkts): 10.0.0.6 (4046 pkts)
Live: 88s   pps~14.6   dropped~0   | last: Capturing on 'Wi‑Fi: en0'

pps: ▁▁▂▂▃▄▅▆▆▇▆▅▄▃▂▂▁  (max 1372/bucket)

Top flow (bytes): UDP 10.0.0.6:57315 ↔ 203.0.113.123:443 (1359.3KB)
Top flow (pkts):  UDP 10.0.0.6:57315 ↔ 203.0.113.123:443 (1284 pkts)

What should I click?
• Domains (human view)  (press D)
• Weird stuff (troubleshoot)  (press W)
• Flows (raw)  (press F)
• Timeline (Gantt + Scatter)  (press T)
  ↳ Detected: High-latency flows (rough) (29 flows)

Domains

Domains  (Enter show flows, s sort (conn/bytes/fail), c clear, Esc back)

  1 wikipedia.com                      conn=9  bytes=21.0KB  q=9  r=6  fail=0  ips=2
❯ 2 chat.openai.com                    conn=5  bytes=28.2KB  q=5  r=3  fail=0  ips=2

Domain details
chat.openai.com