It's simply not worth it, it's like going back in time 20 years. Then I run it, and it shows bugger all, I suspect I need to find and install more libraries (tcell, gowid), which themselves require massive downloads. Wireshark is the worlds foremost network protocol analyzer, and is the de facto standard across many industries and educational institutions. I had to install 540MB of support files just to run 'go get /gcla/termshark/cmd/termshark'.

If I want a quick overview of a given machine I load up iftop, which isn't very thrilling on my desktop at the momentĪll of these are trivial to install (except for the RTP perl script which I have as a custom apt-gettable package) and don't require non-standard interpreters and package managers. This feature will require a lot of extra memory to be consumed by wireshark in order to store the reassembly buffers and is disabled by default. Usually I'm looking at RTP streams, so I run it through some perl to decode įor wider monitoring, at key points on the network I use ntop to see what's IP Reassembly is a feature in Wireshark and TShark to automatically reassemble all fragmented IP Datagrams into a full IP packet before calling the higher layer dissector. My first port of call tends to be tcpdump, with various filters and greps to pick out what I want.

Wireshark tshark