Analyze traffic remotely over ssh w/ wireshark

Analyze traffic remotely over ssh w/ wireshark

 

ssh [email protected] 'tshark -f "port !22" -w -' | wireshark -k -i

This captures traffic on a remote machine with tshark, sends the raw pcap data over the ssh link, and displays it in wireshark. Hitting ctrl+C will stop the capture and unfortunately close your wireshark window. This can be worked-around by passing -c # to tshark to only capture a certain # of packets, or redirecting the data through a named pipe rather than piping directly from ssh to wireshark. I recommend filtering as much as you can in the tshark command to conserve bandwidth. tshark can be replaced with tcpdump thusly:
ssh [email protected] tcpdump -w - 'port !22' | wireshark -k -i -

ssh root@HOST tcpdump -U -s0 -w - 'not port 22' | wireshark -k -i
analyze traffic remotely over ssh w/ wireshark

When using tcpdump, specify -U option to prevent buffering.

tcpdump -v -i <INTERFACE> -s 0 -w /tmp/sniff.pcap port <PORT> # On the remote side

Sniffing network to generate a pcap file in CLI mode on a remote host and open it via local Wireshark ( GUI ).

Then hit ^C to stop, get the file by scp, and you can now use wireshark like this :
wireshark /tmp/sniff.pcap

If you have tshark on remote host, you could use that :
wireshark -k -i <(ssh -l root <REMOTE HOST> tshark -w - not tcp port 22)

The last snippet comes from http://wiki.wireshark.org/CaptureSetup/Pipes
Show sample output | Comments (0) | Add to favourites | Report as malicious
mkfifo /tmp/fifo; ssh-keygen; ssh-copyid root@remotehostaddress; sudo ssh root@remotehost "tshark -i eth1 -f 'not tcp port 22' -w -" > /tmp/fifo &; sudo wireshark -k -i /tmp/fifo;

analyze traffic remotely over ssh w/ wireshark

Please check out my blog article on this for more detail. http://jdubb.net/blog/2009/08/07/monitor-wireshark-capture-real-time-on-remote-host-via-ssh/

sudo ssh -Y remoteuser@remotehost sudo wireshark

analyze traffic remotely over ssh w/ wireshark

This allows you to display the wireshark program running on remote pc to your local pc

 原文：
http://www.commandlinefu.com/commands/view/4373/analyze-traffic-remotely-over-ssh-w-wireshark