babyshark – flows-first packet capture TUI

Babyshark is a PCAP TUI that helps you answer:

• What’s using the network?
• What looks broken/weird?
• What should I select next?

This is free and open source software.

Key Features

• Offline: open .pcap / .pcapng and browse:
  • flows list → packets list → follow stream.
  • stream search with highlighting + n / N navigation.
• Live: capture and inspect traffic in the TUI:
  • list capture interfaces.
  • live capture with optional display filter.
  • optional write-to-file while capturing.
• Per-flow analysis:
  • Health badges — colored dot (green/yellow/red) on each flow based on RST, incomplete handshakes, retransmissions.
  • Asymmetry labels — DL/UL suffix in flow list + download-heavy/upload-heavy/balanced in details (falls back to A>B/B>A when local side is ambiguous).
  • TCP timing — handshake RTT, server think time, data transfer duration in the details pane.
  • TLS version display — shows negotiated version from ServerHello when visible, flags deprecated versions (<= TLS 1.1).
• Weird detectors:
  • TCP resets, handshake-not-completed, DNS failures, retransmit/OOO hints, high-latency flows.
  • Deprecated TLS — flags flows using TLS 1.0 or 1.1.
  • Chatty hosts — flags ≥10 flows to the same destination within 60 seconds.
• Timeline view (T):
  • Gantt — phase-colored horizontal bars (handshake / TLS / data / close) with hostname labels.
  • Scatter — per-packet direction/retransmit dot plot.
  • Color legends, pattern callouts, and plain-English narrative in details.
• Notes/export:
  • bookmark flows.
  • export markdown report (latest + timestamped copies).

Website: github.com/vignesh07/babyshark
Support:
Developer: MIT License
License: Vignesh Natarajan

babyshark is written in Rust. Learn Rust with our recommended free books and free tutorials.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.