OK, rustup etc installed and it looks amazing and there is lots of great stuff in the initial view - I'm investigating "Weird stuff".

I completely get where you are going with this tool and I think you have absolutely nailed it except for the very, very initial bit. I think running babyshark with no params should effectively run babyshark --list-ifaces and ask for which one(s) to use. That's what wireshark does.

You might also spell out that capital letters mean just that. Is there a reason for capital letters being needed in the first place for actions?

I remember Ethereal and when Wireshark came out. Your babyshark looks like a pretty decent way to get non experts into looking at pcaps.

Thank you for your work

Thanks a lot. No reason to have upper case letters besides forcing intent and not move on accidental key presses. However, I have 'q' not mapped to upper case so I missed the obvious footgun :)