Pktscope

Wireshark's three panes, in the terminal, on any interface. Including the raw-IP tunnel devices where tcpdump's ethernet assumptions break.

pktscope is an eBPF packet analyzer for Linux: it gives you Wireshark's three panes in a terminal, on any interface, including the raw-IP tunnel devices where tcpdump's ethernet assumptions break.

A packet list colored by what the payload turned out to be, a folding protocol tree where every field knows the bytes it decodes, and a hex pane that highlights those exact bytes. Selecting a field moves the highlight in the bytes, so "which two bytes are the checksum" stops being a counting exercise.

The thing you would otherwise reach for is tcpdump -w followed by opening the file in Wireshark, or tshark to stay in the shell. That means a capture file, a copy off the box, and a context switch to a GUI before you can read a single byte range. pktscope reads packets where they are, and it decides where byte zero is per interface rather than assuming an ethernet header that tunnel devices do not have.

No capture file, no copy off the box, no GUI. pktscope attaches TCX hooks on both ingress and egress, snaps up to 1536 bytes per frame into a 4 MB ring buffer, and decodes in the terminal. Both programs return TCX_NEXT on every path, so nothing is dropped, delayed, or rewritten.