---
id: pyshark
version: "0.6"
license: MIT
license_treatment: permissive
maintenance: active
---

# pyshark — Python wrapper for tshark, allowing python packet parsing using wireshark dissectors

License: permissive · Maintenance: active · Downloads: 1.0M/mo

## What it is and what it does

Pyshark is a Python wrapper around tshark that lets you parse network packets without reimplementing Wireshark's dissectors. Instead of parsing packets from scratch, it delegates to tshark's XML export and reads the structured output, giving you access to all protocol layers and fields that Wireshark understands. You can read from saved capture files (PCAP, PCAP-NG, etc.), live network interfaces, or remote hosts running rpcapd, and filter packets using BPF or Wireshark display filters.

The package is built on four runtime dependencies: lxml for XML parsing, termcolor for terminal output, packaging for version handling, and appdirs for cross-platform file paths. It supports Python 3.7 and later, and the repository is actively maintained with recent commits, though the maintainer has noted capacity constraints and welcomes contributors.

Use it for:

- Analyze saved network captures programmatically to extract protocol fields, build traffic reports, or detect anomalies.
- Capture and inspect live traffic on a network interface in real time, filtering by protocol or BPF rules.
- Decrypt encrypted traffic (WEP, WPA-PWD, WPA-PSK) and parse the decrypted packets using Wireshark dissectors.
- Build network monitoring or security analysis tools that leverage Wireshark's protocol knowledge without reimplementing parsers.
- Automate packet inspection workflows that would otherwise require manual Wireshark GUI interaction.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Pyshark wraps tshark (Wireshark's command-line tool) to parse network packets in Python using Wireshark's dissectors, supporting both file-based and live packet capture.

Yes. Pyshark is a solid choice if you need to parse network packets in Python and want to reuse Wireshark's dissectors rather than writing your own. The install friction is low, the license is permissive, there are no known vulnerabilities, and the project is actively maintained. The main gotcha is the external tshark dependency—you must have Wireshark installed separately. If you're comfortable with that requirement and need programmatic packet analysis, this is a practical tool.

## Install

pip install pyshark
uv add pyshark
poetry add pyshark

## Installing pyshark

Before you install: Low friction: pure Python wheel with four lightweight runtime dependencies (lxml, termcolor, packaging, appdirs). Maintenance is active but the author has noted capacity constraints and is seeking contributors.

License in practice: MIT license is permissive—you can use, modify, and distribute pyshark freely in commercial and private projects with minimal restrictions.

Quickstart:

pip install pyshark

import pyshark
cap = pyshark.FileCapture('/path/to/capture.pcap')
packet = cap[0]
print(packet.ip.src)

Requires tshark (Wireshark command-line utility) to be installed and in PATH; on macOS may require XCode command-line tools for libxml support.

Verify before relying:

- Whether tshark version compatibility issues affect parsing of specific protocol types or capture formats.
- Performance characteristics when parsing very large capture files or high-volume live captures.
- Current maintenance timeline and responsiveness to bug reports given the stated contributor shortage.

## Package facts

- License: MIT (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: active
- Downloads: 1.0M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

network packet parsing python, wireshark packet analysis, tshark python wrapper, live packet capture python, pcap file parsing, network traffic analysis, packet dissection python, network-analysis, packet-capture, wireshark-integration

[View on SkillFed](https://skillfed.io/packages/pyshark) · [View on PyPI](https://pypi.org/project/pyshark/)