11 stable releases

2.7.1 Nov 6, 2023
2.6.0 Aug 15, 2023
2.5.0 Jul 24, 2023
2.4.0 Mar 6, 2023
1.0.0 May 18, 2022

#326 in Network programming

Download history 158/week @ 2023-08-15 181/week @ 2023-08-22 85/week @ 2023-08-29 79/week @ 2023-09-05 169/week @ 2023-09-12 220/week @ 2023-09-19 76/week @ 2023-09-26 228/week @ 2023-10-03 167/week @ 2023-10-10 90/week @ 2023-10-17 85/week @ 2023-10-24 195/week @ 2023-10-31 126/week @ 2023-11-07 153/week @ 2023-11-14 96/week @ 2023-11-21 103/week @ 2023-11-28

527 downloads per month
Used in rpltree


1.5K SLoC


Crate Crate Crate Documentation dependency status

A Rust interface to TShark, the famous network protocol analyzer. TShark is a part of Wireshark distribution. This crate provides an API to start TShark and analyze it's output. It lets you capture packet data from a live network or read packets from a previously saved capture file, printing a decoded form of those packets. TShark's native capture file format is pcapng format, which is also the format used by Wireshark and various other tools.

TShark application must be installed for this crate to work properly.

This crates supports both offline processing (using pcap file) and live analysis (using an interface or a fifo).


// Creates a builder with needed tshark parameters
let builder = rtshark::RTSharkBuilder::builder()

// Start a new tshark process
let mut rtshark = builder.spawn()
    .unwrap_or_else(|e| panic!("Error starting tshark: {e}"));

// read packets until the end of the PCAP file
while let Some(packet) = rtshark.read().unwrap_or_else(|e| {
    eprintln!("Error parsing tshark output: {e}");
}) {
    for layer in packet {
        println!("Layer: {}", layer.name());
        for metadata in layer {
            println!("\t{}", metadata.display());

Development rules

New parameters

There is actually no specific work to add more TShark parameters. If you miss an important parameter, you can create an issue. But if you want something to be added quickly, please do a patch proposal with the missing parameter or feature (it is easy!). Of course, any new proposal should include documentation to explain how to use it and an unit test to validate it.


This library follows the Semantic Versioning rules https://semver.org/, including :

  • Only make breaking changes when you increment the major version. Don't break the build.
  • Don't add any new public API (no new pub anything) in patch-level versions. Always increment the minor version if you add any new pub structs, traits, fields, types, functions, methods or anything else.


Many thanks to Emmanuel Touzery for creating Hotwire. Core parts of this crate are coming from this tool.


Licensed under either of

at your option.


Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, as defined in the Apache-2.0 license, shall be dual licensed as above, without any additional terms or conditions.


~39K SLoC