Flowshark

Flowshark is a small terminal pcap viewer for Wireshark users who want to inspect captures without learning every tshark option up front.

It is intentionally an MVP: packet parsing is delegated to tshark, and the TUI shows the matching command for the current view.

The packet view follows Wireshark's basic shape: packet list first, with packet details and packet bytes available on demand.

Usage

flowshark -r capture.pcap
flowshark --read capture.pcap

During development:

go run ./cmd/flowshark -r capture.pcap

Keys

Key	Action
q	Quit
/	Enter Wireshark Display Filter input
s	Show tcp.stream eq N for the selected packet
d	Show or hide packet details and bytes
1	Focus the packet list
2	Focus packet details
3	Focus packet bytes
[ / ]	Scroll packet details
{ / }	Scroll packet bytes
p	Jump to packet list
Enter	Follow the current TCP stream
b	Back one view
Esc	Back / cancel input
?	Show help

Requirements

Install Wireshark or tshark and make sure tshark is available in PATH.