Show HN: Babyshark – Wireshark made easy (terminal UI for PCAPs)

29•eigen-vector•2h ago

Hey all, I built babyshark, a terminal UI for PCAPs aimed at people who find Wireshark powerful but overwhelming.

The goal is “PCAPs for humans”: Overview dashboard answers what’s happening + what to click next

Domains view (hostnames first) → select a domain → jump straight to relevant flows (works even when DNS is encrypted/cached by using observed IPs from flows)

Weird stuff view surfaces common failure/latency signals (retransmits/out-of-order hints, resets, handshake issues, DNS failures when visible)

From there you can drill down: Flows → Packets → Explain (plain-English hints) / follow stream

Commands: Offline: babyshark --pcap capture.pcap

Live (requires tshark): babyshark --list-ifaces then babyshark --live en0

Repo + v0.1.0 release: https://github.com/vignesh07/babyshark

Would love feedback on UX + what “weird detectors” you’d want next.

Comments

bombcar•1h ago

WHILE DO; DO; DO; DO; DO; DO

dmbche•33m ago

10/10

jetbalsa•1h ago

This might be a clone of termshark as it does the same thing for the most part. Also to note that the Author's Github profile shows a good bit of vibe coding as of late.

Looking over the commit history of this project, I'm about 90% sure it was entirely done with a AI Coding Agent, and not even a very good one.

eigen-vector•1h ago

Thanks for the look. Babyshark is inspired by a bunch of terminal tools (termshark included), but the focus here is different: domains/weirdness-first drilldowns + "explain" + live-mode hostname hints (including observed IPs when DNS is encrypted/cached). If you try it and have specific gaps vs termshark, I'd love concrete feedback /issues.

john_strinlai•50m ago

the overwhelming part of wireshark is, at least in my experience teaching networking at a college level, the actual networking part. protocols, flows, packet structure, etc. kids tend to be up to speed on the UI part pretty quickly.

what the kids in my classes really struggle with is actually using any command line stuff (at least for a month or two), because it is so foreign to them (coming from GUI-only experience).

what specific parts are made easier with babyshark, compared to wireshark? the github readme didnt really sell me on the "easier than GUI" part, nor did your description here. is it the "explain (plan-English hints)" part? if so, i think you should focus on that. right now it looks pretty bare bones (e.g. "Weird stuff" does not seem easier or super helpful from a learning perspective)

eigen-vector•46m ago

I'm not trying to say it's better than the GUI but it hopes to be more guided. it’s *opinionated* about the first 60 seconds:

- *Overview dashboard*: immediately surfaces top talkers/flows + “what should I click next” instead of dropping you into the full packet list. - *Domains-first pivot*: `D` shows hostnames and lets you jump from a domain → the relevant flows. It also works when DNS answers aren’t visible (DoH/DoT/cached) by using observed IPs from SNI/Host flows. - *Weird stuff*: `W` is a curated set of “likely problems” (retransmits/out-of-order hints, resets, handshake issues, DNS failures when visible) with a short “why it matters” and a drill-down. - *Explain*: `?` gives plain-English hints for a selected flow + suggested next steps (follow stream, filter, pivot to domains/weird).

So it’s basically a guided triage layer on top of tshark/pcap data, with the “where do I start?” path baked in.

If you’ve got a specific teaching use-case (e.g. “why is this slow?” or “which host is generating traffic?”), I’d love to tune the Overview/Weird detectors around that. Open to PRs as well.

john_strinlai•32m ago

>So it’s basically a guided triage layer on top of tshark/pcap data, with the “where do I start?” path baked in.

i think there is definitely room for something like this, it just (at first glance from the readme at least) seems like the guided part of this tool is bolted on as a bit of an after thought.

it feels like you are currently in an odd position where the user is expected to know the networking jargon already, be able to recognize that something might be "weird" at a glance, but also not know how to drill down into the data. i think that is probably a small overlap of people.

if i were you, i would lean all-in on making it a learning tool.

>If you’ve got a specific teaching use-case (e.g. “why is this slow?” or “which host is generating traffic?”), I’d love to tune the Overview/Weird detectors around that.

i will put some thought into some real-world examples of what i would be interested in, from a teaching perspective. your post caught my eye because i am starting my wireshark module next week, so it is certainly timely.

eigen-vector•21m ago

Yeah, right now it's closer to "triage for non-experts" than "full teaching tool," and l agree there's an awkward middle where it assumes you recognize some concepts (flows/ports/latency) while trying to help with the drilldown.

The direction I want to push it in is exactly what you're describing; make it a learning tool, where each detector/view answers: 1) What am I seeing? (plain language) 2) Why might it matter? 3) What's the next click? 4) What term should I learn? (glossary link)

If you're about to teach a Wireshark module next week, two super useful things would be: • 3-5 common lab prompts you give students (e.g. "identify the DNS failure," "find the top talker," "spot a TCP reset," "why is this slow?") • one small pcap you already use (or even just describe its scenario)

I can tune Overview/Weird/Explain around those and make the guided layer feel like the main product rather than a thin overlay. Also: if your students are GUl-only early on, that's a good callout - I should improve the README to frame Babyshark as "guided analysis," not "terminal is easier than GUI."

I'm also happy for your students to get hands on by sending PRs for things they wish are intuitive from the get go.

ghxst•26m ago

How does it compare against tshark?

eigen-vector•23m ago

This isn't meant as a replacement for tshark. It actually uses tshark for the live capture part.

tshark is the engine; Babyshark is the guided Ul on top of it. • tshark: raw packet/field dump + powerful filters, but you have to know what fields to ask for and how to stitch the story together. • Babyshark: gives you an opinionated workflow (Overview → Domains/Weird → Flows → Packets/ Stream) with "explain/why it matters" text, curated detectors, and one-key drilldowns.

For live capture, Babyshark uses tshark -T fields to extract things like DNS qname / TLS SNI / HTTP host; for offline PCAP it parses enough to build flows + summaries.

So: if you already live in tshark one-liners, tshark is faster. If you're trying to understand what's happening or teach/debug quickly, Babyshark is a nicer front-end.

UNIX99, a UNIX-like OS for the TI-99/4A

FreeBSD doesn't have Wi-Fi driver for my old MacBook. AI build one for me

The Age Verification Trap: Verifying age undermines everyone's data protection

What is f(x) ≤ g(x) + O(1)? Inequalities With Asymptotics

Show HN: PgDog – Scale Postgres without changing the app

Ladybird adopts Rust

Show HN: Babyshark – Wireshark made easy (terminal UI for PCAPs)

Elsevier shuts down its finance journal citation cartel

The challenges of porting Shufflepuck Cafe to the 8 bits Apple II

'Viking' was a job description, not a matter of heredity: Ancient DNA study

SIM (YC X25) Is Hiring the Best Engineers in San Francisco

Show HN: Sowbot – open-hardware agricultural robot (ROS2, RTK GPS)

Magical Mushroom – Europe's first industrial-scale mycelium packaging producer

ASML unveils EUV light source advance that could yield 50% more chips by 2030

A simple web we own

Scent, in Silico

Binance fired employees who found $1.7B in crypto was sent to Iran

Americans are destroying Flock surveillance cameras

Benchmarks for concurrent hash map implementations in Go

Generalized Sequential Probability Ratio Test for Families of Hypotheses [pdf]

The Lighthouse: How extreme isolation transforms the body and mind

femtolisp: A lightweight, robust, scheme-like Lisp implementation

Emulating Goto in Scheme with Continuations

Show HN: AI Timeline – 171 LLMs from Transformer (2017) to GPT-5.3 (2026)

A lithium-ion breakthrough that could boost range and lower costs

Disappointing Phones

I built Timeframe, our family e-paper dashboard

Stop Killing Games update says EU petition advances

The peculiar case of Japanese web design (2022)

How Can Infinity Come in Many Sizes?

UNIX99, a UNIX-like OS for the TI-99/4A

FreeBSD doesn't have Wi-Fi driver for my old MacBook. AI build one for me

The Age Verification Trap: Verifying age undermines everyone's data protection

What is f(x) ≤ g(x) + O(1)? Inequalities With Asymptotics

Show HN: PgDog – Scale Postgres without changing the app

Ladybird adopts Rust

Show HN: Babyshark – Wireshark made easy (terminal UI for PCAPs)

Elsevier shuts down its finance journal citation cartel

The challenges of porting Shufflepuck Cafe to the 8 bits Apple II

'Viking' was a job description, not a matter of heredity: Ancient DNA study

SIM (YC X25) Is Hiring the Best Engineers in San Francisco

Show HN: Sowbot – open-hardware agricultural robot (ROS2, RTK GPS)

Magical Mushroom – Europe's first industrial-scale mycelium packaging producer

ASML unveils EUV light source advance that could yield 50% more chips by 2030

A simple web we own

Scent, in Silico

Binance fired employees who found $1.7B in crypto was sent to Iran

Americans are destroying Flock surveillance cameras

Benchmarks for concurrent hash map implementations in Go

Generalized Sequential Probability Ratio Test for Families of Hypotheses [pdf]

The Lighthouse: How extreme isolation transforms the body and mind

femtolisp: A lightweight, robust, scheme-like Lisp implementation

Emulating Goto in Scheme with Continuations

Show HN: AI Timeline – 171 LLMs from Transformer (2017) to GPT-5.3 (2026)

A lithium-ion breakthrough that could boost range and lower costs

Disappointing Phones

I built Timeframe, our family e-paper dashboard

Stop Killing Games update says EU petition advances

The peculiar case of Japanese web design (2022)

How Can Infinity Come in Many Sizes?

Show HN: Babyshark – Wireshark made easy (terminal UI for PCAPs)

Comments