[gerdesj]

I was with your parent until I remembered I haven't actually given it a go! In my defense I have a low five digit Slashdot ID (and I lurked for some years before signing up) so if anyone can comment without actually reading the OP, let alone giving it a go: Its me!

(digs out git ...)

[gerdesj]

OK, rustup etc installed and it looks amazing and there is lots of great stuff in the initial view - I'm investigating "Weird stuff".

I completely get where you are going with this tool and I think you have absolutely nailed it except for the very, very initial bit. I think running babyshark with no params should effectively run babyshark --list-ifaces and ask for which one(s) to use. That's what wireshark does.

You might also spell out that capital letters mean just that. Is there a reason for capital letters being needed in the first place for actions?

I remember Ethereal and when Wireshark came out. Your babyshark looks like a pretty decent way to get non experts into looking at pcaps.

Thank you for your work

[eigen-vector]

Thanks a lot. No reason to have upper case letters besides forcing intent and not move on accidental key presses. However, I have 'q' not mapped to upper case so I missed the obvious footgun :)