webShark is a Wireshark-like webapp powered by sharkd and all its dissectors 🕵️
Client-Side RTP playback powered by WASM/ffmpeg 🚀
Mount your PCAP content directory to location /captures and launch webshark
docker-compose up -d
docker run -ti --rm -p 8085:8085 -v $(pwd)/captures:/captures ghcr.io/qxip/webshark:latest
Browse to your webshark-ng instance, ie: http://localhost:8085/webshark
Docker image build args:
| Arg | Default | Purpose |
|---|---|---|
WEBSHARK_UI_MODE |
full |
full shows the PCAP file browser; kiosk hides it (public demos) |
WIRESHARK_REF |
v4.4.6 |
Pinned Wireshark tag for reproducible sharkd builds |
SHARKD_BUILD_JOBS |
4 |
make -jN parallelism (raise only if the builder has enough RAM) |
WEBSHARK_UI_REF |
1.0.4 |
webshark-ui git tag |
Example:
docker build --build-arg WEBSHARK_UI_MODE=full --build-arg WIRESHARK_REF=v4.4.6 -t webshark .Offline UI fonts (Roboto / Material Icons) are vendored under web/fonts/ so the UI works without CDN access.
Uploads are streamed to disk via multipart. Files larger than ~2GB no longer crash Node's fs.write integer limit.
Set STENOGRAPHER_URL (e.g. https://steno.example.com:1234) to enable remote queries:
curl -X POST http://localhost:8085/webshark/stenographer \
-H 'content-type: application/json' \
-d '{"query":"port 5060 and after 1m ago","name":"sip-last-minute.pcap"}'Status: GET /webshark/stenographer/status
Browser-side WASM (wiregasm) as a sharkd replacement is not bundled yet — it needs a separate UI/runtime path. Track progress in issue #41.
This program is free software based on a fork of GPLv2 webshark by Jakub Zawadzki and sponsored by qxip
Dissections powered by tshark sharkd from Wireshark Project. See LICENSE for details