Skip to content

Commit

Permalink
Merge branch 'v24docs'
Browse files Browse the repository at this point in the history
  • Loading branch information
gcla committed Jul 11, 2022
2 parents d01a1d5 + f7f929d commit e436160
Show file tree
Hide file tree
Showing 7 changed files with 161 additions and 31 deletions.
13 changes: 11 additions & 2 deletions .all-contributorsrc
Original file line number Diff line number Diff line change
Expand Up @@ -6,9 +6,9 @@
"files": [
"README.md"
],
"imageSize": 72,
"imageSize": 100,
"commit": false,
"contributorsPerLine": 8,
"contributorsPerLine": 7,
"commitConvention": "none",
"contributors": [
{
Expand Down Expand Up @@ -483,6 +483,15 @@
"contributions": [
"ideas"
]
},
{
"login": "elig0n",
"name": "elig0n",
"avatar_url": "https://avatars.githubusercontent.com/u/31196036?v=4",
"profile": "https://github.com/elig0n",
"contributions": [
"ideas"
]
}
]
}
4 changes: 2 additions & 2 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
# Changelog

## [Unreleased]

## [2.4.0] - 2022-07-11
### Added

- You can now search for information in packets, in similar fashion to Wireshark's packet search. Hit `ctrl-f`
Expand All @@ -12,6 +11,7 @@

### Changed

- Now you can build and install termshark with one command: `go install github.com/gcla/termshark/v2/cmd/termshark`
- Fixed a bug that resulted in stream reassembly sporadically failing and displaying a blank screen.
- Termshark will now, by default, suppress errors from tshark. You can change this via the minibuffer
`set suppress-tshark-errors` command.
Expand Down
103 changes: 88 additions & 15 deletions README.md

Large diffs are not rendered by default.

15 changes: 12 additions & 3 deletions docs/FAQ.md
Original file line number Diff line number Diff line change
Expand Up @@ -92,7 +92,7 @@ If you start to page up quickly, you will likely approach a range of packets tha

## Termshark is too bright!

Termshark v2 supports dark-mode! Hit Esc to bring up the main menu then "Toggle Dark Mode". See the [User Guide](UserGuide.md#dark-mode).
Termshark v2 supports dark-mode! Hit Esc to bring up the main menu then "Toggle Dark Mode". See the [User Guide](UserGuide.md#dark-mode). As of termshark v2.4, dark-mode is the default.

## Termshark's colors are wrong!

Expand Down Expand Up @@ -310,6 +310,14 @@ tshark -G fields
then parsing the output into a nested collection of Go maps, and serializing it to `$XDG_CACHE_HOME/termshark/tsharkfieldsv3.gob.gz`.
If the user creates a new termshark profile, an option is provided to link to a Wireshark profile. To gather a list of these profiles, termshark runs
```bash
tshark -G folders
```
and parses out the global and personal configuration directories.
Finally, termshark runs tshark to generate the list of all valid columns and their names. These are used to populate a dropdown menu showing valid column choices when the user configures their column set. Termshark runs
```bash
Expand Down Expand Up @@ -437,9 +445,10 @@ As much as possible, I want termshark to work "right out of the box", and to me
## What's next?
Termshark v2 implemented stream reassembly, a "What's next" feature from v1. For Termshark v3, some possibilities are:
As I write this, I'm about to release termshark v2.4. Here's what might come in v2.5 and beyond:
- Built-in support for editing packet color profiles
- Expose many more of tshark's `-z` options
- HTTP statistics and Wireshark's I/O graph
- Allow the user to start reading from available interfaces once the UI has started
- And since tshark can be customized via the TOML config file, don't be so trusting of its output - there are surely bugs lurking here
- Anything you raise on Github issues - let me know what features you'd like!
5 changes: 2 additions & 3 deletions docs/Packages.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,9 +4,8 @@ Here's how to install termshark on various OSes and with various package manager

## Arch Linux

- [termshark-bin](https://aur.archlinux.org/packages/termshark-bin): binary
package which simply copies the released binary to install directory. Made by
[jerry73204](https://github.com/jerry73204)
- [termshark](https://archlinux.org/packages/community/x86_64/termshark/): The
official package.
- [termshark-git](https://aur.archlinux.org/packages/termshark-git): Compiles
from source, made by [Thann](https://github.com/Thann)

Expand Down
50 changes: 45 additions & 5 deletions docs/UserGuide.md
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ Termshark provides a terminal-based user interface for analyzing packet captures
- [Macros](#macros)
- [Transfer a pcap File](#transfer-a-pcap-file)
- [Configuration](#configuration)
- [Profiles](#profiles)
- [Dark Mode](#dark-mode)
- [Packet Colors](#packet-colors)
- [Themes](#themes)
Expand All @@ -40,7 +41,7 @@ Termshark is inspired by Wireshark, and depends on tshark for all its intelligen

```console
$ termshark -h
termshark v2.3.0
termshark v2.4.0

A wireshark-inspired terminal user interface for tshark. Analyze network traffic interactively from your terminal.
See https://termshark.io for more information.
Expand All @@ -58,6 +59,7 @@ Application Options:
-f=<capture filter> Apply capture filter.
-t=<timestamp format>[a|ad|adoy|d|dd|e|r|u|ud|udoy] Set the format of the packet timestamp printed in summary lines.
--tty=<tty> Display the UI on this terminal.
-C, --profile=<profile> Start with this configuration profile.
--pass-thru=[auto|true|false] Run tshark instead (auto => if stdout is not a tty). (default: auto)
--log-tty Log to the terminal.
-h, --help Show this help message.
Expand Down Expand Up @@ -392,6 +394,7 @@ Many of termshark's operations can be initiated from the command-line. After ope
- **clear-filter** - Clear the current display filter
- **clear-packets** - Clear the current pcap
- **columns** - Configure termshark's columns
- **config** - Show termshark's config file (Unix-only)
- **convs** - Open the conversations view
- **filter** - Choose a display filter from those recently-used
- **help** - Show one of several help dialogs
Expand All @@ -401,6 +404,7 @@ Many of termshark's operations can be initiated from the command-line. After ope
- **marks** - Show file-local and global packet marks
- **menu** - Open the UI menubar
- **no-theme** - Clear theme for the current terminal color mode
- **profile** - Profile actions - create, use, delete, etc
- **quit** - Quit termshark
- **recents** - Load a pcap from those recently-used
- **set** - Set various config properties (see `help set`)
Expand Down Expand Up @@ -492,17 +496,51 @@ https://user-images.githubusercontent.com/45680/122692277-0de7e180-d202-11eb-964

## Configuration

### Profiles

Termshark v2.4 introduces support for Wireshark-like profiles. A simple mental model for a profile called "work" is a separate toml file, stored as
`$XDG_CONFIG_HOME/termshark/profiles/work/termshark.toml`, whose settings take precedence over the default `termshark.toml` file. When a non-default
profile is active, termshark will display its name at the top of the user-interface. Configuration changes are saved to the currently-active
profile. These include typical termshark settings like dark-mode, columns and theme.

To create a profile, open the command line and type `profile create`. Termshark will open a dialog that lets you name your profile and, optionally,
"link" it to a Wireshark-profile.

![profilecreate](/../gh-pages/images/profilecreate.png?raw=true)

The effect of linking to a Wireshark profile "wshark" is that termshark will run tshark with the flags `-C wshark`. One useful effect of this is that
tshark will generate packet colors according to those configured for the "wshark" Wireshark profile. This allows Wireshark packet coloring rules to be
used flexibly in termshark; create a new termshark profile and link to the Wireshark profile with the colors configured the way you want. Once a
profile is created, you can unlink and re-link to a different Wireshark profile using the `profile unlink` and `profile link` commands respectively.

Once you have profiles configured, you can switch between them using the `profile use` command. Termshark may reload your current packet source if it
determines it needs to regenerate parts of the UI e.g. if packet colors or columns may be different. Note that if you create a new profile "new" while
currently using profile "old", the settings for "new" are initialized from "old" (the toml file is copied); but then further changes apply to profile
"new" only.

Note that some configuration settings are read only from the default profile. These include

- `main.term` - termshark will launch on this tty (Unix-only)




### Dark Mode

If termshark is too bright for your taste, try dark-mode. To enable, hit Esc to open the main menu and select "Toggle Dark Mode".

![darkmode](/../gh-pages/images/darkmode.png?raw=true)

Your choice is stored in the termshark [config file](UserGuide.md#config-file). Dark-mode is supported throughout the termshark user-interface.
Your choice is stored in the termshark [config file](UserGuide.md#config-file) for the currently active profile. Dark-mode is supported throughout the
termshark user-interface.

### Packet Colors

By default, termshark will now display packets in the packet list view colored according to Wireshark's color rules. With recent installations of Wireshark, you can find this file at `$XDG_CONFIG_HOME/wireshark/colorfilters`. Termshark doesn't provide a way to edit the colors - the colors are provided by `tshark`. You can read about Wireshark's support [here](https://www.wireshark.org/docs/wsug_html_chunked/ChCustColorizationSection.html). If you don't like the way this looks in termshark, you can turn it off using termshark's main menu.
By default, termshark will now display packets in the packet list view colored according to Wireshark's default color rules. With recent installations
of Wireshark, you can find this file at `$XDG_CONFIG_HOME/wireshark/colorfilters`. Termshark doesn't provide a way to edit the colors - the colors are
provided by `tshark`. You can read about Wireshark's support
[here](https://www.wireshark.org/docs/wsug_html_chunked/ChCustColorizationSection.html). If you don't like the way this looks in termshark, you can
turn it off using termshark's main menu.

### Themes

Expand Down Expand Up @@ -547,7 +585,7 @@ Termshark saves your selected theme against the terminal color mode, which can b
- 256-color
- truecolor i.e. 24-bit color

The theme is saved in `termshark.toml` under, respectively, the keys:
The theme is saved in the current profile's `termshark.toml` under, respectively, the keys:

- `main.theme-16`
- `main.theme-256`
Expand Down Expand Up @@ -612,7 +650,9 @@ widgets that will have focus when control returns to the container. Unselected m

### Config File

Termshark reads options from a TOML configuration file saved in `$XDG_CONFIG_HOME/termshark/termshark.toml` (e.g. `~/.config/termshark/termshark.toml` on Linux). All options are saved under the `[main]` section. The available options are:
Termshark reads options from a TOML configuration file saved in `$XDG_CONFIG_HOME/termshark/termshark.toml` (e.g. `~/.config/termshark/termshark.toml`
on Linux) if you are using the default profile. If you are using a profile called "work", the settings are saved in
`$XDG_CONFIG_HOME/termshark/profiles/work/termshark.toml`. All options are saved under the `[main]` section. The available options are:

- `always-keep-pcap` (bool) - if true, and if termshark is run on a live packet source (`-i`), when termshark is asked to exit, it will not prompt the user to choose whether to keep or delete the capture.
- `auto-scroll` (bool) - if true, termshark will automatically scroll down when packets are read in a live-capture mode (e.g. `-i eth0`)
Expand Down
2 changes: 1 addition & 1 deletion version.go
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@

package termshark

var Version string = "v2.3.0+"
var Version string = "v2.4.0"

//======================================================================
// Local Variables:
Expand Down

0 comments on commit e436160

Please sign in to comment.