id = "termshark"
name = "Termshark"
homepage = "https://termshark.io"
description = "A wireshark-inspired terminal user interface for tshark. Analyze network traffic interactively from your terminal."
executables = ["termshark"]
[dotfiles]
paths = ["[configHome]/termshark/", "[appData]/termshark/", "%APPDATA%/termshark/"]
secret = []
[commands]
format = 1
label = "Analyze packets"
description = "Open a pcap file or capture from an interface in termshark's terminal UI. Decode-as and pass-through options are left out."
quality = "ai-draft"
parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }
[[commands.source]]
id = "manpage"
kind = "manual"
url = "https://manpages.debian.org/unstable/termshark/termshark.1.en.html"
revision = "termshark 2.4.0-5"
evidence = """
termshark [options] [FilterOrFile]
-i=interface
Interface to read.
-r=file
Pcap file to read.
-Y=displaY_filter
Apply display filter.
-f=capture_filter
Apply capture filter.
"""
[[commands.field]]
id = "pcap"
label = "Pcap file"
type = "path"
option = ["-r"]
path = { kind = "file", role = "input" }
sources = ["manpage"]
[[commands.field]]
id = "interface"
label = "Capture interface"
type = "string"
option = ["-i"]
sources = ["manpage"]
[[commands.field]]
id = "display_filter"
label = "Display filter"
description = "Wireshark display filter applied to the packets shown."
type = "string"
option = ["-Y"]
sources = ["manpage"]
[[commands.field]]
id = "capture_filter"
label = "Capture filter"
description = "BPF filter used when capturing from an interface."
type = "string"
option = ["-f"]
sources = ["manpage"]
[[commands.task]]
id = "open_pcap"
label = "Open a pcap file"
fields = ["pcap", "display_filter"]
required = ["pcap"]
[[commands.task]]
id = "live"
label = "Capture live"
fields = ["interface", "capture_filter"]
required = ["interface"]
[[commands.group]]
id = "basic"
label = "Basic"
fields = ["pcap", "interface", "display_filter", "capture_filter"]
