### Termshark Macro Creation Examples

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

These examples demonstrate how to create keyboard macros in termshark using the `map` command. Macros allow users to define custom shortcuts for sequences of keypresses, simplifying complex or repetitive navigation actions. They use Vim-syntax for key representation.

```plaintext
map <C-s> /
map <f1> :quit<enter><enter>
map <f1> ZZ
map <f2> <esc>d
map <f5> <tab><tab><down><tab>
map <f6> <tab><tab><up><tab>
```

--------------------------------

### Example TOML Theme Configuration for Termshark

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

This TOML snippet demonstrates how to define a custom theme for Termshark. It includes definitions for color palettes and how UI elements like buttons can be styled using these colors, potentially referencing other defined themes.

```toml
[dracula]
  gray1 = "#464752"
  ...
  orange = "#ffb86c"
  purple = "#bd93f9"
  red = "#ff5555"
  white = "#f8f8f2"
  yellow = "#f1fa8c"

[dark]
  button = ["dracula.black","dracula.gray3"]
  button-focus = ["dracula.white","dracula.magenta"]
  button-selected = ["dracula.white","dracula.gray3"]
  ...
  
[light]
  button = ["dracula.black","dracula.white"]
  button-focus = ["dracula.black","dracula.purple"]
  button-selected = ["dracula.black","dracula.gray3"]
  ...
```

--------------------------------

### Build Termshark from Source

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

These commands are used to build and install Termshark after cloning the repository. 'go generate' is needed if theme assets have changed, otherwise 'go install' is sufficient.

```bash
export GO111MODULE=on
go generate ./	
go install ./	
```

--------------------------------

### Install Termshark with Snapcraft

Source: https://github.com/gcla/termshark/blob/master/docs/Packages.md

Installs termshark using the Snapcraft universal package manager. This command works on many Linux distributions. Note that Snap installations may have limitations with reading network interfaces.

```bash
snap install termshark
```

--------------------------------

### Install Termshark on Android via Termux

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This sequence of commands installs Termshark on Android devices using Termux. It first installs necessary repositories and packages, including `termux-api` for clipboard access, and then installs Termshark itself. It also shows how to create a shortcut for Termshark within Termux.

```bash
pkg install root-repo
pkg install termux-api
pkg install termshark

mkdir .shortcuts
cd .shortcuts
ln -s $(which termshark)
```

--------------------------------

### Termshark CLI: Use configuration profile

Source: https://context7.com/gcla/termshark/llms.txt

Shows how to start Termshark with a specific configuration profile. This allows users to load custom settings for columns, colors, and other display options.

```bash
# Start with specific profile
termshark -r capture.pcap -C myprofile
```

--------------------------------

### Termshark Help and Options

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Displays the help message and available command-line options for Termshark. This is useful for understanding how to run Termshark and its various functionalities, such as reading from interfaces, files, or applying filters.

```console
$ termshark -h
termshark v2.4.0

A wireshark-inspired terminal user interface for tshark. Analyze network traffic interactively from your terminal.
See https://termshark.io for more information.

Usage:
  termshark [FilterOrPcap]

Application Options:
  -i=<interfaces>                                            Interface(s) to read.
  -r=<infile/fifo>                                           Pcap file/fifo to read. Use - for stdin.
  -w=<outfile>                                               Write raw packet data to outfile.
  -d=<layer type>==<selector>,<decode-as protocol>           Specify dissection of layer type.
  -D                                                         Print a list of the interfaces on which termshark can capture.
  -Y=<displaY filter>                                        Apply display filter.
  -f=<capture filter>                                        Apply capture filter.
  -t=<timestamp format>[a|ad|adoy|d|dd|e|r|u|ud|udoy]        Set the format of the packet timestamp printed in summary lines.
      --tty=<tty>                                            Display the UI on this terminal.
  -C, --profile=<profile>                                    Start with this configuration profile.
      --pass-thru=[auto|true|false]                          Run tshark instead (auto => if stdout is not a tty). (default: auto)
      --log-tty                                              Log to the terminal.
  -h, --help                                                 Show this help message.
  -v, --version                                              Show version information.

Arguments:
  FilterOrPcap:                                              Filter (capture for iface, display for pcap), or pcap to read.

If --pass-thru is true (or auto, and stdout is not a tty), tshark will be
executed with the supplied command-line flags. You can provide
tshark-specific flags and they will be passed through to tshark (-n, -d, -T,
etc). For example:

$ termshark -r file.pcap -T psml -n | less

```

--------------------------------

### Build Termshark Package for Snapcraft

Source: https://github.com/gcla/termshark/blob/master/docs/Maintainer.md

This snippet outlines the process of building a Termshark snap package. It involves forking and cloning the termshark-snap repository, editing the `snapcraft.yaml` file to update the version and the specific Termshark commit hash, and then running the `snapcraft` command to build the package. If necessary, `snapcraft clean` can be used to clear previous builds. The resulting snap can be installed using `snap install --dangerous`.

```bash
# Clone the forked termshark-snap repository
# Edit snapcraft.yaml to update version and the go get command with the correct hash
# Example for v2.0.3:
# version: 2.0.3
# go get github.com/gcla/termshark/v2/cmd/termshark@73dfd1f6cb8c553eb524ebc27d991f637c1ac5ea
snapcraft
# Optional: snapcraft clean
# Install the built snap:
snap install --dangerous ./termshark_2.0.3_amd64.snap
# Run termshark:
/snap/bin/termshark -h
```

--------------------------------

### Install Termshark with APT (Debian, Kali, Ubuntu)

Source: https://github.com/gcla/termshark/blob/master/docs/Packages.md

Installs termshark using the APT package manager. This command is applicable to Debian, Kali Linux, and Ubuntu systems. Ensure your package lists are updated before installation.

```bash
apt update
apt install termshark
```

--------------------------------

### Install Termshark with PPA (Ubuntu < 19.10)

Source: https://github.com/gcla/termshark/blob/master/docs/Packages.md

Installs termshark on older Ubuntu versions (< 19.10) using a Personal Package Archive (PPA). This involves adding the PPA and then installing the package.

```bash
sudo add-apt-repository --update ppa:nicolais/termshark
sudo apt install termshark
```

--------------------------------

### Termshark Capture Output Example

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Shows the console output after a capture process using Termshark is stopped (e.g., by pressing Ctrl+C). It indicates the location where the captured packets have been saved.

```console
$ termshark -i eth0
Packets read from interface eth0 have been saved in /home/gcla/.cache/termshark/pcaps/eth0--2021-09-03--11-20-58.pcap
```

--------------------------------

### Install Termshark using Go Modules

Source: https://github.com/gcla/termshark/blob/master/README.md

Installs the latest stable version of Termshark using Go modules. Ensure GO111MODULE is set to 'on'. This command fetches and installs the termshark executable.

```bash
go install github.com/gcla/termshark/v2/cmd/termshark@v2.4.0
```

--------------------------------

### Install Termshark with Nix (NixOS)

Source: https://github.com/gcla/termshark/blob/master/docs/Packages.md

Installs termshark on NixOS by adding the unstable nixpkgs channel, updating it, and then installing termshark using nix-env. This method is specific to NixOS.

```bash
nix-channel --add https://nixos.org/channels/nixpkgs-unstable
nix-channel --update
nix-env -iA nixpkgs.termshark
```

--------------------------------

### Create a New Termshark Profile

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Command to create a new configuration profile in Termshark. This command initiates an interactive dialog for naming the profile and optionally linking it to a Wireshark profile.

```bash
profile create
```

--------------------------------

### Analyze Heap Profile with go tool pprof

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Uses the 'go tool pprof' command to analyze a generated heap profile. This command starts an HTTP server to visualize the profile data, aiding in the identification of memory-related performance issues.

```bash
go tool pprof -http=:6061 $(which termshark) ~/.cache/termshark/mem-20190929122218.prof
```

--------------------------------

### Install Termshark with Homebrew (macOS)

Source: https://github.com/gcla/termshark/blob/master/docs/Packages.md

Installs termshark using the Homebrew package manager on macOS. This command first updates Homebrew and then installs the termshark package.

```bash
brew update
brew install termshark
```

--------------------------------

### Transfer Pcap File using Magic Wormhole CLI

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Demonstrates how to receive a pcap file transferred via magic wormhole on a remote machine. This assumes a magic wormhole client is installed and a pcap file has been sent from Termshark.

```bash
$ wormhole receive 9-mosquito-athens
Receiving file (2.8 MB) into: vrrp.pcap
ok? (y/N): y
Receiving (->tcp:10.6.14.67:45483)..
100%|███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████| 2.83M/2.83M [00:00<00:00, 161MB/s]
Received file written to vrrp.pcap
```

--------------------------------

### Install Termshark with Termux (Android)

Source: https://github.com/gcla/termshark/blob/master/docs/Packages.md

Installs termshark on Android via Termux. This requires installing the root-repo first, then termshark. Additional packages like Termux:API may be needed for specific functionalities.

```bash
pkg install root-repo
pkg install termshark
```

```bash
pkg install termux-api
```

--------------------------------

### Install Termshark with MacPorts (macOS)

Source: https://github.com/gcla/termshark/blob/master/docs/Packages.md

Installs termshark using the MacPorts package manager on macOS. This involves updating MacPorts and then installing the termshark port.

```bash
sudo port selfupdate
sudo port install termshark
```

--------------------------------

### Configure Browse Command in Termshark

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Defines the external command to open URLs, such as from the main menu. Supports URL replacement with '$1'.

```toml
[main]
  browse-command = ["firefox", "$1"]
```

--------------------------------

### Use an Existing Termshark Profile

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Command to switch to a previously created configuration profile in Termshark. This may trigger a UI regeneration if settings like packet colors or columns differ.

```bash
profile use
```

--------------------------------

### Launch Termshark to Read from Interface

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Launches Termshark to capture and analyze live network traffic from a specified interface. Supports applying capture filters directly on the command line. Packets are saved by default to a cache directory, but can be explicitly saved using the -w flag. Multiple interfaces can be monitored simultaneously.

```bash
termshark -i eth0
termshark -i eth0 -w save.pcap
termshark -i eth0 tcp
termshark -i eth0 -i eth1
```

--------------------------------

### Termshark Command-Line Commands

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

This section lists available commands for termshark's command-line interface. These commands allow users to perform actions such as analyzing capture files, filtering packets, and managing termshark's configuration. Some commands may have Unix-specific availability.

```plaintext
capinfo - Show the current capture file properties (using the `capinfos` command)
clear-filter - Clear the current display filter
clear-packets - Clear the current pcap
columns - Configure termshark's columns
config - Show termshark's config file (Unix-only)
convs - Open the conversations view
filter - Choose a display filter from those recently-used
help - Show one of several help dialogs
load - Load a pcap from the filesystem
logs - Show termshark's log file (Unix-only)
map - Map a keypress to a key sequence (see `help map`)
marks - Show file-local and global packet marks
menu - Open the UI menubar
no-theme - Clear theme for the current terminal color mode
profile - Profile actions - create, use, delete, etc
quit - Quit termshark
recents - Load a pcap from those recently-used
set - Set various config properties (see `help set`)
streams - Open the stream reassemably view
theme - Set a new termshark theme
unmap - Remove a keypress mapping made with the `map` command
wormhole - Transfer the current pcap using magic wormhole
```

--------------------------------

### Termshark Vim-Style Navigation Bindings

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

This section details Vim-style keybindings available in termshark for navigating the UI. These bindings include navigation within tables, switching panes, and marking/jumping to specific packets. They aim to provide a familiar experience for Vim users.

```plaintext
gg - Go to the top of the current table
G - Go to the bottom of the current table
5gg - Go to the 5th row of the table
C-w C-w - Switch panes (same as tab)
C-w = - Equalize pane spacing
ma - Mark current packet (use a through z)
'a - Jump to packet marked 'a'
mA - Mark current packet + pcap (use A through Z)
'A - Jump to packet + pcap marked 'A'
'' - After a jump; jump back to prior packet
ZZ - Quit without confirmation
```

--------------------------------

### Launch Termshark to Read from Pcap File

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Launches Termshark to inspect the contents of a pcap file. Supports applying display filters directly on the command line. The 'Recent' button allows quick access to previously analyzed pcap files.

```bash
termshark -r test.pcap
termshark -r test.pcap icmp
```

--------------------------------

### Get Termshark using Go Get (Older Go Versions)

Source: https://github.com/gcla/termshark/blob/master/README.md

Fetches Termshark using the 'go get' command, suitable for Go versions between 1.14 and 1.17. After running this, ensure '~/go/bin/' is added to your system's PATH to access the termshark executable.

```bash
go get github.com/gcla/termshark/v2/cmd/termshark
```

--------------------------------

### Configure Copy Command in Termshark

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Specifies the command executed when copying selected packet data. Defaults to platform-specific clipboard commands.

```toml
[main]
  copy-command = ["xsel", "-i", "-b"]
```

--------------------------------

### Add User to Wireshark Group on Ubuntu/Debian

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Provides bash commands to install Wireshark, reconfigure its common settings, and add the current user to the 'wireshark' group. This is a common method on Ubuntu/Debian systems to allow users to run tshark/dumpcap without root privileges.

```bash
sudo apt-get install wireshark
sudo dpkg-reconfigure wireshark-common
sudo usermod -a -G wireshark $USER
newgrp wireshark
```

--------------------------------

### Configuring Extra tshark Arguments with TOML

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This example demonstrates how to configure additional arguments to be passed to the tshark process by modifying the termshark.toml configuration file. This allows for custom tshark behavior, such as defining display filters for specific protocols.

```toml
[main]
  tshark-args = ["-d","udp.port==2075,cflow","-d","udp.port==9191,cflow","-d","udp.port==2055,cflow","-d","udp.port==2095,cflow"]
```

--------------------------------

### Termshark Output to Non-TTY

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Demonstrates how Termshark defers to tshark when standard output is not a TTY, passing through command-line options. This is useful for piping Termshark's output to other command-line tools for further processing or viewing.

```console
$ termshark -r test.pcap | cat
    1   0.000000 192.168.44.123 → 192.168.44.213 TFTP 77 Read Request, File: C:\IBMTCPIP\lccm.1, Transfer type: octet
    2   0.000000 192.168.44.123 → 192.168.44.213 TFTP 77 Read Request, File: C:\IBMTCPIP\lccm.1, Transfer type: octet

```

--------------------------------

### Link a Wireshark Profile to Termshark Profile

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Command to associate the current Termshark profile with a specific Wireshark profile. This enables Termshark to use Wireshark's packet coloring rules configured in the specified profile.

```bash
profile link
```

--------------------------------

### Configure Copy Command in Termshark

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

This TOML configuration snippet shows how to customize the command used by Termshark to copy data. It specifies using 'xsel' with flags '-i' and '-p' for the primary selection, useful when X11 forwarding is enabled.

```toml
[main]
  copy-command = ["xsel", "-i", "-p"]

```

--------------------------------

### Toggle Dark Mode in Termshark

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Action to enable or disable dark mode in Termshark. The setting is persisted in the active profile's configuration file.

```none
Esc -> Toggle Dark Mode
```

--------------------------------

### Control Termshark with Signals and TTY

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Demonstrates how to suspend and resume Termshark using SIGTSTP (Ctrl+Z on bash) and how to dedicate a specific TTY for Termshark to run in, preventing interference from other terminal processes. This involves launching Termshark with a --tty argument pointing to a designated terminal device.

```bash
termshark -r foo.pcap

tty && sleep infinity
termshark -r foo.pcap --tty=/dev/pts/10
```

--------------------------------

### Unlink a Wireshark Profile from Termshark Profile

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Command to remove the association between the current Termshark profile and its linked Wireshark profile. This allows re-linking to a different Wireshark profile later.

```bash
profile unlink
```

--------------------------------

### Add Custom Arguments to Tshark Invocation

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Allows passing additional arguments to tshark whenever Termshark invokes it to generate protocol dissection (PDML) or other data. This can be used to enable specific tshark features or options.

```toml
[main]
  tshark-args = ["-d","udp.port==2075,cflow]"]
```

--------------------------------

### Termshark TUI Filtering

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Explains how to use the Termshark Text User Interface (TUI) for filtering. Pressing '/' focuses the display filter input. The UI provides real-time validation of filter expressions, changing color to red for invalid syntax and offering auto-completion suggestions. Pressing 'Apply' activates the filter.

```text
/ (to focus display filter)
Press 'Apply' to make the filter value take effect.
```

--------------------------------

### Read Packets from FIFO or Stdin

Source: https://github.com/gcla/termshark/blob/master/docs/UserGuide.md

Enables Termshark to read packet data from a Unix fifo or standard input. This is useful for piping output from tools like tcpdump. Termshark's UI only launches after receiving initial packet data, which is helpful when capture commands require root privileges.

```bash
tcpdump -i eth0 -w - icmp | termshark
```

--------------------------------

### Custom Copy Command for Remote Packet Copying

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This snippet demonstrates how to set a custom command in Termshark's configuration to copy packet sections to a remote pastebin service. It requires the `pastebinit` utility to be installed on the remote machine. The configuration is applied by editing the `termshark.toml` file.

```bash
#!/bin/bash
echo -n "See " && pastebinit
```

```toml
[main]
  copy-command = "/usr/local/bin/ts-copy.sh"
```

--------------------------------

### Capture Process with dumpcap/tshark Fallback (Pseudo-code)

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Illustrates the logic for Termshark's capture process, prioritizing dumpcap but falling back to tshark for extcap interfaces. This pseudo-code shows the execution flow and environment variable usage for capture mode.

```go
cmd := exec.Command(dumpcap, args...)
if cmd.Run() != nil {
   syscall.Exec(tshark, append([]string{tshark}, args...), os.Environ())
}
```

--------------------------------

### Generate CPU Profile with pkill

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Sends the SIGUSR1 signal to the termshark process using pkill to generate a CPU profile. This profile can be used with 'go tool pprof' to analyze CPU usage and identify performance bottlenecks.

```bash
pkill -SIGUSR1 termshark
```

--------------------------------

### Clone Termshark Repository

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This command clones the Termshark project from its GitHub repository. It is the first step for users who wish to build Termshark from source.

```bash
git clone https://github.com/gcla/termshark
```

--------------------------------

### Termshark CLI: List available interfaces

Source: https://context7.com/gcla/termshark/llms.txt

Command to list all available network interfaces that Termshark can capture traffic from. This helps users identify the correct interface for live packet capture.

```bash
termshark -D
```

--------------------------------

### Termshark CLI: Capture from network interface

Source: https://context7.com/gcla/termshark/llms.txt

Shows how to capture live network traffic using Termshark. It includes options for specifying the interface, applying capture filters, and saving captured data to a file.

```bash
# Capture all traffic on eth0
termshark -i eth0

# Capture with capture filter
termshark -i eth0 "port 443"

# Capture and save to file
termshark -i eth0 -w output.pcap
```

--------------------------------

### Build Termshark Package for Termux (Android)

Source: https://github.com/gcla/termshark/blob/master/docs/Maintainer.md

This snippet shows how to set up the Termux environment and build the Termshark package. It involves cloning necessary repositories, modifying the build script to use specific versions of Termshark, and executing the build process within a Docker container. Potential checksum errors need to be addressed by updating the SHA256 hash in the build script.

```bash
docker pull termux/package-builder
cd source/
git clone https://github.com/termux/termux-packages
cd termux-packages
git clone https://github.com/termux/termux-root-packages
cd termux-packages/termux-root-packages/packages/termshark/
# Edit build.sh to change go get and go install commands with the correct UUID
# Example for v2.0.3:
# cd $TERMUX_PKG_BUILDDIR
# go get -d -v github.com/gcla/termshark/v2/cmd/termshark@73dfd1f6cb8c553eb524ebc27d991f637c1ac5ea
# go install github.com/gcla/termshark/v2/cmd/termshark
# Also change TERMUX_PKG_VERSION
# Save and run build script from termux-packages directory:
./scripts/run-docker.sh 
# Inside container:
rm /data/data/.built-packages/termshark
./clean.sh
./build-package.sh termux-root-packages/packages/termshark/
```

--------------------------------

### Generate Heap Profile with pkill

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Sends the SIGUSR2 signal to the termshark process using pkill to generate a heap (memory) profile. This profile is useful for analyzing memory consumption and detecting memory leaks.

```bash
pkill -SIGUSR2 termshark
```

--------------------------------

### Treating PCAP as Live Capture with tcpdump and Termshark (Bash)

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This snippet shows how to use tcpdump to write a capture to a file and then pipe that file to termshark for real-time analysis as if it were a live capture. This is particularly useful on Unix-like systems.

```bash
shell1$ tcpdump -i eth0 -w foo.pcap
shell2$ tail -f -c +0 foo.pcap | termshark
```

--------------------------------

### Monitor Configuration File Changes in Go

Source: https://context7.com/gcla/termshark/llms.txt

Implements a configuration file watcher that monitors a specified file for modifications. Upon detecting changes, it logs the event and can trigger a configuration reload. This uses a Go channel-based approach for asynchronous event handling and includes error management and context cancellation.

```go
package main

import (
	"context"
	"fmt"
	"github.com/gcla/termshark/v2/pkg/confwatcher"
	time "time"
)

func main() {
	ctx := context.Background()

	// Create watcher for config file
	watcher := confwatcher.New()

	// Watch configuration file
	configPath := "/home/user/.config/termshark/termshark.toml"
	err := watcher.Add(configPath)
	if err != nil {
		fmt.Printf("Failed to watch config: %v\n", err)
		return
	}
	defer watcher.Close()

	// Monitor for changes
	go func() {
		for {
			select {
			case event := <-watcher.Events():
				fmt.Printf("Config changed: %s (op: %v)\n", event.Name, event.Op)
				// Reload configuration here
			case err := <-watcher.Errors():
				fmt.Printf("Watcher error: %v\n", err)
			case <-ctx.Done():
				return
			}
		}
	}()

	fmt.Println("Watching for configuration changes...")
	time.Sleep(5 * time.Second)
}
```

--------------------------------

### Go: Termshark PSML Column Management

Source: https://context7.com/gcla/termshark/llms.txt

This Go code snippet demonstrates how to manage packet list column specifications and formatting within Termshark's `pkg/shark` package. It shows defining custom fields, parsing column strings, and accessing default columns.

```go
package main

import (
	"fmt"
	"github.com/gcla/termshark/v2/pkg/shark"
)

// Define custom column
field := shark.PsmlField{
	Token:      "%Cus",
	Filter:     "tcp.srcport",
	Occurrence: 0,
}

// Parse column string
var parsedField shark.PsmlField
err := parsedField.FromString("%Cus:tcp.srcport:0:R")
if err != nil {
	fmt.Printf("Error: %v\n", err)
} else {
	fmt.Printf("Token: %s, Filter: %s\n", parsedField.Token, parsedField.Filter)
}

// Default columns
columns := shark.DefaultPsmlColumnSpec
for _, col := range columns {
	fmt.Printf("Column: %s (%s)\n", col.Name, col.Field.Token)
}
// Output:
// Column: No. (%m)
// Column: Time (%t)
// Column: Source (%s)
// Column: Dest (%d)
// Column: Proto (%p)
// Column: Length (%L)
// Column: Info (%i)
```

--------------------------------

### Set dumpcap Capabilities for Non-Root Execution

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Sets specific capabilities (CAP_NET_RAW and CAP_NET_ADMIN) for the dumpcap binary using setcap. This is an alternative method to allow dumpcap to run without root privileges on Linux systems.

```bash
sudo setcap cap_net_raw,cap_net_admin+eip /usr/sbin/dumpcap
```

--------------------------------

### Termshark Live Capture with Dumpcap and Tshark

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

For live network traffic, termshark uses dumpcap to capture packets into a temporary file. This file is then piped to a tshark process, which continuously reads and processes the data in PSML format for real-time display. The '-l' switch may enhance data delivery speed.

```bash
dumpcap -P -i eth0 -f <capture filter> -w <tmpfile>
tail -f -c +0 tmpfile | tshark -T psml -i - -l -Y '<expression from ui>' -o gui.column.format:"..."
```

--------------------------------

### Generate tshark Column Formats

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Runs tshark with the '-G column-formats' option to generate a list of all valid columns and their corresponding names. This data populates a dropdown menu for users to select columns when configuring their display.

```bash
tshark -G column-formats
```

--------------------------------

### Go: Termshark Hex Dump Formatting

Source: https://context7.com/gcla/termshark/llms.txt

This Go code snippet demonstrates the `format.HexDump` function from Termshark's `pkg/format` package. It shows how to format binary packet data into a Wireshark-style hexadecimal dump, including options for custom ASCII delimiters.

```go
package main

import (
	"fmt"
	"github.com/gcla/termshark/v2/pkg/format"
)

// Sample packet data
data := []byte("GET / HTTP/1.1\r\nHost: example.com\r\n\r\n")

// Basic hex dump
hexOutput := format.HexDump(data)
fmt.Println(hexOutput)
// Output:
// 00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  |GET / HTTP/1.1..|
// 00000010  48 6f 73 74 3a 20 65 78  61 6d 70 6c 65 2e 63 6f  |Host: example.co|
// 00000020  6d 0d 0a 0d 0a                                    |m....|

// With custom delimiters
opts := format.Options{
	LeftAsciiDelimiter:  "[",
	RightAsciiDelimiter: "]",
}
customOutput := format.HexDump(data, opts)
fmt.Println(customOutput)
// Output:
// 00000000  47 45 54 20 2f 20 48 54  54 50 2f 31 2e 31 0d 0a  [GET / HTTP/1.1..]

```

--------------------------------

### Parse CLI Arguments with go-flags in Go

Source: https://context7.com/gcla/termshark/llms.txt

Parses command-line arguments for the Termshark application using the go-flags library. It defines structures for options and demonstrates how to process arguments, handling potential parsing errors. The parsed options can then be used to configure application behavior, such as specifying input files or display filters.

```go
package main

import (
	"fmt"
	"github.com/gcla/termshark/v2/pkg/cli"
	flags "github.com/jessevdk/go-flags"
	"os"
)

func main() {
	// Parse termshark options
	var opts cli.Termshark
	parser := flags.NewParser(&opts, flags.Default)

	// Simulate command line: termshark -r test.pcap -Y "http"
	args := []string{" -r", "test.pcap", "-Y", "http"}
	_, err := parser.ParseArgs(args)
	if err != nil {
		fmt.Fprintf(os.Stderr, "Parse error: %v\n", err)
		return
	}

	fmt.Printf("Pcap file: %s\n", opts.Pcap)
	fmt.Printf("Display filter: %s\n", opts.DisplayFilter)
	// Output:
	// Pcap file: test.pcap
	// Display filter: http

	// Check for pass-through mode
	if cli.FlagIsTrue(opts.PassThru) {
		fmt.Println("Running in tshark pass-through mode")
	}
}
```

--------------------------------

### Retrieve tshark Profile Folders

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Executes tshark with the '-G folders' option to obtain a list of global and personal Wireshark configuration directories. This information is used when a user creates a new termshark profile and wants to link it to an existing Wireshark profile.

```bash
tshark -G folders
```

--------------------------------

### Combine Display Filter and Search Expression with tshark

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Combines an active display filter from the UI with a user-provided search expression when executing tshark. This ensures that both criteria are met for packet selection. The output is in PSML format.

```bash
tshark -T psml -r my.pcap -Y '(<display filter from ui>) && (<search expression from ui>)' -o gui.column.format:"No.","%m"
```

--------------------------------

### Generate tshark Field Completions

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Runs tshark with the '-G fields' option to generate a list of all available fields. This output is then parsed and serialized into a cache file for providing auto-completions in the termshark filter widget.

```bash
tshark -G fields
```

--------------------------------

### Run Termshark in Debug Mode

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Launches Termshark with the '--debug' flag for verbose logging, useful for diagnosing issues. This command is typically used when troubleshooting performance problems or unexpected behavior.

```bash
termshark --debug -r foo.pcap
```

--------------------------------

### Termshark CLI: Apply display filter

Source: https://context7.com/gcla/termshark/llms.txt

Illustrates how to apply display filters in Termshark to narrow down packet analysis results. This allows users to focus on specific protocols or network conversations.

```bash
# Filter HTTP traffic
termshark -r capture.pcap -Y "http"

# Filter specific IP and port
termshark -r capture.pcap -Y "ip.addr == 192.168.1.100 && tcp.port == 443"
```

--------------------------------

### Termshark CLI: Read pcap file

Source: https://context7.com/gcla/termshark/llms.txt

Demonstrates how to read a pcap file using the Termshark command-line interface. This is a basic command to initiate packet analysis from a file.

```bash
termshark -r capture.pcap
```

--------------------------------

### Load Network Conversations with tshark in Go

Source: https://context7.com/gcla/termshark/llms.txt

Loads and processes network conversation statistics (TCP, UDP, etc.) from a pcap file using tshark's conversation statistics feature. It constructs and prints the tshark command, demonstrating how to specify protocols and filters for analysis. This functionality is crucial for understanding network traffic patterns.

```go
package main

import (
	"context"
	"fmt"
	"github.com/gcla/gowid"
	"github.com/gcla/termshark/v2/pkg/convs"
)

type ConvsHandler struct{}

func (h *ConvsHandler) OnData(data string) {
	fmt.Printf("Conversation data received:\n%s\n", data)
}

func (h *ConvsHandler) AfterDataEnd(success bool) {
	if success {
		fmt.Println("Conversation loading completed successfully")
	} else {
		fmt.Println("Conversation loading failed")
	}
}

func main() {
	// Create conversation loader
	cmds := convs.MakeCommands()
	ctx := context.Background()
	loader := convs.NewLoader(cmds, ctx)

	// Load TCP and UDP conversations from pcap
	pcapFile := "capture.pcap"
	protocols := []string{"tcp", "udp"}
	filter := ""  // No additional filter
	absoluteTime := false
	resolveNames := false

	handler := &ConvsHandler{}

	// Note: requires gowid.IApp interface, simplified here
	// loader.StartLoad(pcapFile, protocols, filter, absoluteTime, resolveNames, app, handler)

	// Generate tshark command for conversations
	cmd := cmds.Convs(pcapFile, protocols, filter, absoluteTime, resolveNames)
	fmt.Printf("Command: %s %v\n", cmd.String())
	// Output: tshark -q -r capture.pcap -z conv,tcp -z conv,udp
}
```

--------------------------------

### Define Wireshark Field Types in Go

Source: https://context7.com/gcla/termshark/llms.txt

Defines constants for Wireshark field types, such as integers, strings, and network addresses. This package maps Wireshark's internal field type identifiers to Go constants, enabling correct parsing, display, and comparison of network protocol fields. It illustrates how to check field types and apply appropriate comparison logic.

```go
package main

import (
	"fmt"
	"github.com/gcla/termshark/v2/pkg/fields"
)

func main() {
	// Check field type by name
	fieldType := fields.FieldTypeMap["FT_IPv4"]
	if fieldType == fields.FT_IPv4 {
		fmt.Println("Field is IPv4 address type")
	}

	// Common field types
	fmt.Printf("Boolean type: %v\n", fields.FT_BOOLEAN)
	fmt.Printf("String type: %v\n", fields.FT_STRING)
	fmt.Printf("UINT32 type: %v\n", fields.FT_UINT32)
	fmt.Printf("IPv6 type: %v\n", fields.FT_IPv6)
	fmt.Printf("Protocol type: %v\n", fields.FT_PROTOCOL)

	// Field type determines how data is displayed and compared
	// Used internally for proper sorting and filtering
	if fieldType == fields.FT_IPv4 || fieldType == fields.FT_IPv6 {
		fmt.Println("Network address field - use numeric comparison")
	} else if fieldType >= fields.FT_UINT8 && fieldType <= fields.FT_UINT64 {
		fmt.Println("Unsigned integer - use numeric comparison")
	} else if fieldType == fields.FT_STRING {
		fmt.Println("String field - use lexicographic comparison")
	}
}
```

--------------------------------

### Execute tshark for Packet Search

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Executes tshark to find packets matching a specific display filter expression from the UI. This command is used when a user initiates a packet search with the 'Display Filter' option. The output is formatted in PSML.

```bash
tshark -T psml -r my.pcap -Y '<search expression from ui>' -o gui.column.format:"No.","%m"
```

--------------------------------

### Go: Termshark PDML Tree Model Parsing

Source: https://context7.com/gcla/termshark/llms.txt

This Go code snippet shows how to parse PDML (Packet Details Markup Language) data, typically obtained from `tshark -T pdml`, into Termshark's `pdmltree.Model`. It demonstrates unmarshalling XML and iterating through the protocol tree structure.

```go
package main

import (
	"encoding/xml"
	"fmt"
	"github.com/gcla/termshark/v2/pkg/pdmltree"
)

// PDML structure from tshark -T pdml
pdmlData := `<?xml version="1.0"?>
<pdml>
  <packet>
    <proto name="geninfo" pos="0" size="60">
      <field name="num" show="1"/>
      <field name="len" show="60"/>
    </proto>
    <proto name="eth" pos="0" size="14">
      <field name="eth.src" show="00:11:22:33:44:55"/>
      <field name="eth.dst" show="66:77:88:99:aa:bb"/>
    </proto>
  </packet>
</pdml>`

// Parse PDML into model
var model pdmltree.Model
err := xml.Unmarshal([]byte(pdmlData), &model)
if err != nil {
	fmt.Printf("Parse error: %v\n", err)
	return
}

// Iterate through protocol tree
iter := model.Children()
for iter.Next() {
	child := iter.Value().(*pdmltree.Model)
	fmt.Printf("Protocol: %s, Position: %d, Size: %d\n",
		child.Name, child.Pos, child.Size)
}
```

--------------------------------

### Load Specific Packet Range with TShark

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This command demonstrates how Termshark efficiently loads specific ranges of packets from a pcap file using tshark. It filters packets by frame number, allowing for quick access without processing the entire file.

```bash
tshark -T pdml -r huge.pcap -Y 'frame.number >= 12340000 and frame.number < 12341000'
```

--------------------------------

### Termshark CLI: Pass-through mode to tshark

Source: https://context7.com/gcla/termshark/llms.txt

Demonstrates how Termshark can operate in a pass-through mode to tshark, especially when stdout is not a terminal. This is useful for piping tshark's output to other tools like jq.

```bash
# When stdout is not a tty, termshark passes through to tshark
termshark -r capture.pcap -T json | jq '.[0]'

# Force tshark mode
termshark -r capture.pcap --pass-thru=true | head
```

--------------------------------

### Termshark TCP Stream Reassembly with Tshark

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

To reassemble TCP streams, termshark initiates two tshark processes. The first uses the '-z follow' option to extract raw stream data, while the second retrieves the stream in PDML format. This allows termshark to map stream chunks to specific packets.

```bash
tshark -r my.pcap -q -z follow,tcp,raw,15
tshark -T pdml -r my.pcap -Y "tcp.stream eq 15"
```

--------------------------------

### Capture and filter live traffic with Termshark

Source: https://github.com/gcla/termshark/blob/master/README.md

Captures live network traffic on a specified interface (e.g., 'eth0') and filters for ICMP packets using Termshark. This command is useful for real-time network debugging.

```bash
termshark -i eth0 icmp
```

--------------------------------

### Configure Termshark to Ignore Base16 Colors

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This TOML configuration snippet shows how to instruct Termshark to ignore Base16 color remappings in the terminal. This is useful when terminal colors appear incorrect due to external color schemes.

```toml
[main]
  ignore-base16-colors = true
```

--------------------------------

### Termshark Conversation Analysis with Tshark

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Termshark analyzes network conversations by running tshark with the '-z conv' option for specified protocols (e.g., eth, ip, tcp). If a display filter is active and 'Limit to filter' is enabled, tshark is invoked with the filter appended to the conversation options.

```bash
tshark -r my.pcap -q -z conv,eth -z conv,ip -z conv,tcp
tshark -r my.pcap -q -z conv,eth,http -z conv,ip,http -z conv,tcp,http
```

--------------------------------

### Termshark Display Filter Validation

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Termshark validates user-entered display filter expressions by invoking tshark with the filter applied to an empty pcap file. The exit code of this tshark process determines the validity of the filter, with a zero code indicating a valid filter.

```bash
tshark -Y '<expression from ui>' -r empty.pcap
```

--------------------------------

### Inspect PCAP file with Termshark

Source: https://github.com/gcla/termshark/blob/master/README.md

Opens a local pcap file (e.g., 'test.pcap') in Termshark for inspection. This command allows you to view packet details and apply filters within the terminal UI.

```bash
termshark -r test.pcap
```

--------------------------------

### Termshark Tshark Packet Data Retrieval

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

Termshark uses tshark to retrieve packet data in PSML format for display. It can also fetch packet structure and hex/byte data using PDML or Pcap output formats. This is typically used when loading a pcap file or processing a specific range of packets.

```bash
tshark -T psml -r my.pcap -Y '<expression from ui>' -o gui.column.format:"..."
tshark -T pdml -r my.pcap -Y '<expression from ui> and frame.number >= 1000 and frame.number < 2000'
tshark -F pcap -r my.pcap -Y '<expression from ui> and frame.number >= 1000 and frame.number < 2000' -w -
```

--------------------------------

### Configure Termshark Disk Cache Size

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This TOML configuration snippet sets the maximum disk cache size for Termshark. When the cache exceeds this limit (in megabytes), Termshark will automatically delete the oldest captured files to stay within the configured size, preventing excessive disk space usage. A value of -1 disables this feature.

```toml
[main]
  disk-cache-size-mb = 100
```

--------------------------------

### Override Terminal Type in Termshark Configuration

Source: https://github.com/gcla/termshark/blob/master/docs/FAQ.md

This TOML configuration allows overriding the terminal type that Termshark uses for color interpretation. This can be helpful for ensuring correct color rendering in different terminal environments.

```toml
[main]
  term = "screen-256color"
```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.