TShark
TShark: A free, scriptable Wireshark-based analyzer for live captures, PCAP files, and protocol workflows. Ranked #2 of 30 in Network Protocol Analyzers by our editors (9.2/10); pricing: Free plan; best for scriptable packet analysis.
At a glance
- Editor score9.2 / 10
- PricingFree plan
- Best forScriptable packet analysis
- Free planYes
- Paid fromFree
- DeploymentBoth
- Facts checked20 Sep 2026
Where it wins
- Live and offline analysis with PCAP and PCAPNG support
- Structured JSON, PDML, and fields output for automation
- Remote capture, filtering, flow analysis, and TLS decryption support
Where it doesn't
- Command-line interface lacks Wireshark's graphical workflow
- TLS decryption requires appropriate configured secrets or keys
- No AI features for assisted analysis
Our verdict on TShark
TShark is the command-line network protocol analyzer included in the Wireshark distribution. It captures traffic from live network interfaces, reads saved PCAP and PCAPNG files, decodes protocols, applies capture and display filters, and produces packet or structured analysis output. Its audience includes network professionals, security teams, developers, educators, and anyone who needs packet analysis without a graphical interface.
TShark is open source and available at no cost, with support for Windows, macOS, and Linux. The published capabilities cover both local and remote capture, including rpcap and TCP capture interfaces, making it suitable for scripted collection across different environments. Its output formats include JSON, PDML, and fields formats, which fit automated workflows and downstream processing. Because it is distributed as part of Wireshark, it shares Wireshark's protocol dissection system and supports reading and writing common capture formats.
The feature depth is strongest in filtering, decoded protocol output, flow and stream-following analysis, and automation. TLS decryption is supported when appropriate secrets or keys are provided, adding value for investigations that require decrypted protocol data. TShark is a strong choice for command-line analysis, repeatable workflows, remote capture, and integration with scripts. Teams that prefer visual exploration, dashboards, or an interface designed around graphical packet inspection should choose Wireshark's graphical application instead of relying on TShark alone.
Your product? Our editors can test TShark in depth and publish a review, labelled as paid · from $149/mo →
TShark pricing
TShark fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Deployment | Both |
| Capture sources | Both |
| PCAP support | Yes |
| Traffic decryption | Yes |
| CLI tools | Yes |
| Remote capture | Yes |
| Flow analysis | Yes |
| Deployment | Self-hosted, Desktop |
| Platforms | Windows, macOS, Linux |
| Support | Community, Docs |
| Built for | Solo, Small business, Mid-market, Enterprise (editorial estimate) |
| Pricing | Free plan |
| Website | wireshark.org |
| Facts checked | 20 Sep 2026 |
Alternatives to TShark
- WiresharkA broad, free desktop analyzer for live captures, PCAP files, filtering, and protocol inspection.9.4
- ScapyA free, programmable toolkit for crafting, capturing, decoding, and analyzing packets.9.0
- KismetA flexible, free toolkit for wireless capture, monitoring, analysis, and distributed sensors.8.9
TShark vs the competition
- TShark vs Wireshark
- TShark vs Scapy
- TShark vs Kismet
- TShark vs tcpdump
- TShark vs Arkime
- TShark vs Ettercap
Compare TShark with any tool side by side →
Also Ranked In
TShark is ranked in 3 of our directories.
Used TShark? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used TShark for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
TShark is listed in our Network Protocol Analyzers directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/tshark/"><img src="https://www.itechguides.com/best/badge/tshark.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update