pyshark

What it is and what it does

Pyshark is a Python wrapper around tshark that lets you parse network packets without reimplementing Wireshark's dissectors. Instead of parsing packets from scratch, it delegates to tshark's XML export and reads the structured output, giving you access to all protocol layers and fields that Wireshark understands. You can read from saved capture files (PCAP, PCAP-NG, etc.), live network interfaces, or remote hosts running rpcapd, and filter packets using BPF or Wireshark display filters.

The package is built on four runtime dependencies: lxml for XML parsing, termcolor for terminal output, packaging for version handling, and appdirs for cross-platform file paths. It supports Python 3.7 and later, and the repository is actively maintained with recent commits, though the maintainer has noted capacity constraints and welcomes contributors.

Use it for:

• Analyze saved network captures programmatically to extract protocol fields, build traffic reports, or detect anomalies.
• Capture and inspect live traffic on a network interface in real time, filtering by protocol or BPF rules.
• Decrypt encrypted traffic (WEP, WPA-PWD, WPA-PSK) and parse the decrypted packets using Wireshark dissectors.
• Build network monitoring or security analysis tools that leverage Wireshark's protocol knowledge without reimplementing parsers.
• Automate packet inspection workflows that would otherwise require manual Wireshark GUI interaction.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Pyshark wraps tshark (Wireshark's command-line tool) to parse network packets in Python using Wireshark's dissectors, supporting both file-based and live packet capture.

Yes. Pyshark is a solid choice if you need to parse network packets in Python and want to reuse Wireshark's dissectors rather than writing your own. The install friction is low, the license is permissive, there are no known vulnerabilities, and the project is actively maintained. The main gotcha is the external tshark dependency—you must have Wireshark installed separately. If you're comfortable with that requirement and need programmatic packet analysis, this is a practical tool.

Install

pyshark on PyPI

pip install pyshark

uv add pyshark

poetry add pyshark

Installing pyshark

Before you install

Low friction: pure Python wheel with four lightweight runtime dependencies (lxml, termcolor, packaging, appdirs). Maintenance is active but the author has noted capacity constraints and is seeking contributors.

License in practice

MIT license is permissive—you can use, modify, and distribute pyshark freely in commercial and private projects with minimal restrictions.

Quickstart

pip install pyshark

import pyshark
cap = pyshark.FileCapture('/path/to/capture.pcap')
packet = cap[0]
print(packet.ip.src)

Requires tshark (Wireshark command-line utility) to be installed and in PATH; on macOS may require XCode command-line tools for libxml support.

Verify before relying

• Whether tshark version compatibility issues affect parsing of specific protocol types or capture formats.
• Performance characteristics when parsing very large capture files or high-volume live captures.
• Current maintenance timeline and responsiveness to bug reports given the stated contributor shortage.

Package facts

Evidence: pyshark-0.6-py3-none-any.whl

Keywords: wireshark, capture, packets, parsing, packet

Tags

More Networking packages