pktscope
A Wireshark-style network packet analyzer that runs entirely in the terminal, built on eBPF for handling tricky raw-IP tunnel traffic like WireGuard and GRE.
🔗 Visit pktscope
Description
Wireshark is the standard tool for inspecting network traffic, but it needs a graphical environment, which is awkward on a headless server or inside a container where most real debugging happens today. pktscope brings that same three-pane experience — packet list, protocol details, hex view — into a terminal you can SSH into, which matters a lot more than it sounds once you're troubleshooting a production box with no desktop.
It captures traffic using eBPF/TCX hooks rather than the traditional pcap approach, which lets it observe passively and filter in-kernel for better performance, and it specifically handles raw-IP tunnel interfaces (tunl0, WireGuard, GRE) that traditional tools often struggle to decode cleanly. It supports interactive keyboard and mouse navigation within the terminal UI and display filtering by protocol, aiming at the same debugging workflow as Wireshark or tcpdump but without needing a GUI or a separate machine to view the capture.
💬 Our review
The short version: a well-scoped tool for a real gap — nobody wants to run Wireshark over X11 forwarding on a remote server, and tcpdump's raw output is painful for anything beyond a quick filter, so a genuinely interactive terminal packet analyzer fills a real hole in the toolbox.
Its clearest advantage is native support for tunnel interfaces (WireGuard, GRE, tunl0) that are common in Kubernetes and VPN setups but are exactly the traffic Wireshark and tcpdump handle awkwardly out of the box. The trade-off is maturity and reach: Wireshark's protocol dissector library, built over two decades, is far deeper than any young project can match, so for exotic or rare protocols you'll likely still fall back to Wireshark's pcap files — pktscope is best thought of as the fast, no-GUI-needed tool for everyday remote debugging, not a full replacement.
💰 Pricing
📊 Global score
🤖 AI-enriched data
Open source, double licence BSD/GPL.
Pros
Analyse de paquets en trois volets directement dans le terminal (pas besoin de GUI)
Support natif des interfaces de tunnel (WireGuard, GRE, tunl0)
Capture via hooks eBPF/TCX — filtrage in-kernel performant
Navigation interactive clavier/souris dans le terminal
Cons
Bibliothèque de dissection de protocoles bien plus restreinte que Wireshark
Projet jeune, moins éprouvé sur des cas exotiques
Nécessite Linux + support eBPF/TCX